SC-900 - Microsoft Compliance Solutions - Section 4.4

Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview.

Describe insider risk management in Microsoft Purview as the capability that detects and acts on potentially harmful user activity without exposing unnecessary personal data. Distinguish eDiscovery solutions, which support legal hold and content search for litigation, from audit solutions, which provide a record of user and admin activity for forensic investigation.

insider risk managementeDiscovery solutionsaudit solutions

Practice question for this objective

Free sampleMicrosoft Compliance Solutionsmedium

A security and compliance team is sorting three Microsoft Purview solutions by purpose: insider risk management, eDiscovery, and audit. Which THREE statements correctly match each solution to what it does? Select THREE.

  • AInsider risk management detects and helps act on risky activity by an organisation's own users Correct
  • BAudit applies encryption and a watermark to sensitive documents as they are shared
  • CeDiscovery identifies, holds, and exports content that may serve as evidence in legal matters Correct
  • DeDiscovery calculates the organisation's compliance score from completed actions
  • EAudit provides a searchable record of user and administrator activity across services Correct
Insider risk management addresses internal user activity, eDiscovery preserves and exports legal evidence, and audit records user and admin activity for later search. Each solution owns a distinct job: insider risk watches internal behaviour, eDiscovery handles legal preservation and export, and audit keeps a searchable activity record. The distractors borrow capabilities from sensitivity labels and Compliance Manager, which sit outside all three.

Why A is correct: Insider risk management is purpose-built to surface and respond to malicious or inadvertent internal user activity.

Why B is wrong: Encryption and watermarking are sensitivity label functions; audit only records activity and protects nothing.

Why C is correct: eDiscovery preserves and produces electronically stored information for investigations and legal cases.

Why D is wrong: The compliance score is produced by Compliance Manager, not eDiscovery, which deals with legal content rather than scoring.

Why E is correct: Audit logs user and admin operations so teams can search them during security or compliance investigations.

See more SC-900 practice questions, answers explained.

More in this domain

Back to all Microsoft Compliance Solutions objectives, or the SC-900 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.