Microsoft compliance solutions make up 20-25% of SC-900, and many candidates find them harder than the security sections because the product names sound alike. This set covers the first half of that area: the Service Trust Portal, Microsoft’s privacy principles, Compliance Manager and compliance score, and how Microsoft Purview classifies data so you can find and protect it.
This is the fifth set in our SC-900 series (Questions 41-50), written for the skills outline that takes effect on October 21, 2026. If you are new to the series, start with SC-900 Questions 1-10. Every question is an original practice scenario, not a copy of a real exam item.
Pick your answer before you reveal it, and pay attention to why each wrong option does not fit. On SC-900, the wrong answers are usually real Microsoft tools with a different job.
Question 41: An Auditor Wants Microsoft’s Audit Reports
An external auditor asks Contoso for Microsoft’s own ISO 27001 certificate and SOC 2 report for Microsoft 365 as part of a vendor review. Where should Contoso get these documents?
A) Compliance Manager
B) The Microsoft Service Trust Portal
C) Audit in Microsoft Purview
D) Microsoft Defender for Cloud regulatory compliance dashboard
👁 Reveal Answer
Correct Answer: B
Explanation: The Service Trust Portal is where Microsoft publishes its independent audit reports, certifications, and other documents that explain how it protects customer data in its cloud services. A helps you assess and improve your own organization’s compliance with regulations; it does not hold Microsoft’s audit reports. C records user and admin activity in your tenant. D shows how your Azure resources measure against standards, which is again about your environment, not Microsoft’s certifications.
Reference: Get started with the Microsoft Service Trust Portal
Question 42: Microsoft and Advertising
A school district asks whether Microsoft scans its staff emails and documents to show them targeted ads. Which of Microsoft’s privacy principles directly addresses this concern?
A) Transparency
B) Control
C) Security
D) No content-based targeting
👁 Reveal Answer
Correct Answer: D
Explanation: Microsoft’s six privacy principles are control, transparency, security, strong legal protections, no content-based targeting, and benefits to you. No content-based targeting is the commitment not to use customer content such as email, chat, and files for targeted advertising. A is about being clear on how data is collected and used. B is about putting customers in control of their data. C is about protecting data with strong security and encryption. They all matter, but only D speaks to advertising.
Reference: Describe the compliance management capabilities in Microsoft Purview (Microsoft Learn module)
Question 43: Tracking Progress Toward a Regulation
Fabrikam must show its board how well its Microsoft 365 environment meets GDPR requirements, which tasks are still open, and who owns each one. Which Microsoft Purview solution is designed for this?
A) Compliance Manager, with an assessment based on a GDPR regulatory template
B) Microsoft Secure Score
C) The Service Trust Portal
D) eDiscovery
👁 Reveal Answer
Correct Answer: A
Explanation: Compliance Manager helps you manage compliance requirements across regulations. You create assessments from regulatory templates, and each assessment lists improvement actions that you can assign, track, and document, with progress reflected in your compliance score. B measures security configuration, not progress against a regulation. C provides Microsoft’s own compliance documents. D is for finding and preserving content for legal cases.
Reference: Working with improvement actions in Compliance Manager
Question 44: Raising the Compliance Score the Right Way
Fabrikam’s compliance score is lower than expected. The compliance team asks which improvement actions it is responsible for. Which statement is correct?
A) Every improvement action must be completed by the customer, including those for Microsoft’s datacenters
B) Marking failing actions as out of scope is the recommended way to raise the score
C) Compliance Manager uses a shared responsibility model: Microsoft completes its own actions, and the actions on the Improvement actions tab are the ones the organization must complete
D) The score only counts technical actions, so documentation and process tasks never matter
👁 Reveal Answer
Correct Answer: C
Explanation: Compliance Manager works within a shared responsibility model. Some actions are completed automatically by Microsoft, and the actions listed on the Improvement actions tab are the ones your organization is responsible for. Each action is worth points toward the compliance score, and passing an action earns its full points. A ignores Microsoft’s share of the work. B misrepresents your compliance; out of scope is meant for actions that truly do not apply. D is wrong because nontechnical actions, which cover documentation and operational tasks, also exist and contribute to the score.
Reference: Working with improvement actions in Compliance Manager
Question 45: Finding Credit Card Numbers
A retailer wants Microsoft Purview to detect documents and emails that contain credit card numbers. The numbers follow a well-known format with a checksum. What should the retailer use?
A) A built-in sensitive information type for credit card numbers
B) A custom trainable classifier trained on sample invoices
C) A retention label
D) Activity explorer
👁 Reveal Answer
Correct Answer: A
Explanation: Sensitive information types identify content that matches patterns of sensitive information, such as social security, credit card, or bank account numbers, and Purview includes many built-in types. Credit card numbers have a fixed pattern, so a built-in type is the natural fit. B learns from examples and is meant for content without a fixed pattern. C controls how long content is kept, not how it is found. D shows activity on content that has already been labeled or classified.
Reference: Data classification in Microsoft Purview
Question 46: Finding Contracts With No Fixed Pattern
A legal team wants to identify supplier contracts stored across SharePoint. Contracts do not contain a single number or keyword that reliably identifies them, but the team has hundreds of example contracts. Which classification method fits?
A) A sensitive information type based on a regular expression
B) Exact data match
C) A sensitivity label policy
D) A trainable classifier, either pretrained or custom-trained with sample contracts
👁 Reveal Answer
Correct Answer: D
Explanation: Trainable classifiers recognize types of content by learning from examples rather than matching a pattern. Purview provides pretrained classifiers, and you can create custom ones by providing samples of the content you want to recognize. That suits contracts, résumés, or source code. A needs a reliable pattern, which contracts lack. B matches exact values from your own data, such as customer IDs. C publishes labels to users; it does not identify content by itself.
Reference: Data classification in Microsoft Purview
Question 47: Too Many False Positives on Customer IDs
An insurer created a pattern-based sensitive information type for its 9-digit customer IDs, but it also matches order numbers and phone extensions, causing many false alerts. The insurer has a database table with every real customer ID. What should it use instead?
A) Increase the number of characters the pattern must match
B) Exact data match, which compares content against the actual values from the customer table
C) A pretrained trainable classifier for customer records
D) Turn off the sensitive information type and rely on users to label files
👁 Reveal Answer
Correct Answer: B
Explanation: Exact data match identifies sensitive content by matching exact values, so only real customer IDs from the insurer’s own data are detected, not every 9-digit number. A cannot help, because the IDs really are 9 digits. C recognizes kinds of documents, not specific values. D removes automated protection and depends on every user getting it right.
Reference: Data classification in Microsoft Purview
Question 48: Where Is Our Confidential Data?
A compliance officer wants a current list of every item in the organization that carries the “Highly Confidential” sensitivity label or contains passport numbers, along with where each item is stored. Which Purview tool should she use?
A) Activity explorer
B) Audit (Standard)
C) Data explorer (also called content explorer)
D) Compliance Manager
👁 Reveal Answer
Correct Answer: C
Explanation: Data explorer shows a current snapshot of items that have a sensitivity label or retention label or that match a sensitive information type, and where those items are located. Microsoft’s documentation uses both “content explorer” and “data explorer” for this tool. A shows what people did with labeled content over time, not a list of where content sits. B records events. D tracks compliance tasks. Note that counts in Data explorer can take several days to update.
Reference: Get started with Data explorer
Question 49: Who Removed the Labels?
A security manager suspects that several employees downgraded or removed sensitivity labels on files last week before sharing them. Which tool shows these actions?
A) Activity explorer
B) Data explorer
C) The Service Trust Portal
D) Compliance score
👁 Reveal Answer
Correct Answer: A
Explanation: Activity explorer provides a historical view of activities on labeled content, such as labels being applied, changed, downgraded, or removed, plus DLP policy matches. It reports on up to 30 days of data, so last week is well within range. B shows where labeled content is now, not who changed it. C is Microsoft’s compliance documentation. D summarizes compliance progress.
Reference: Get started with activity explorer
Question 50: Seeing the List but Not the Files
An analyst can open Data explorer and see the list of items that match a sensitive information type, along with their locations, but she cannot open the items to read what is inside them. Why?
A) Data explorer never shows item contents to anyone
B) She has a role that lets her see the list of items, but viewing item contents requires the separate Content viewer role
C) The items are older than 30 days
D) She must be a Global Administrator to use Data explorer
👁 Reveal Answer
Correct Answer: B
Explanation: Data explorer separates the two permissions: a List viewer role lets someone see each item and its location, and a Content viewer role lets them view the contents of each item. This follows the principle of least privilege, because many people only need to know where sensitive data is, not read it. A is wrong because content viewing is possible with the right role. C confuses Data explorer with activity explorer’s 30-day window. D is unnecessary and goes against least privilege.
Reference: Get started with Data explorer
Study Tips for Microsoft Purview Compliance
- Microsoft’s compliance vs yours. The Service Trust Portal is Microsoft’s documentation. Compliance Manager tracks your organization’s compliance.
- Learn the six privacy principles. Control, transparency, security, strong legal protections, no content-based targeting, and benefits to you.
- Match the classifier to the content. Fixed patterns use sensitive information types. Kinds of documents use trainable classifiers. Your own exact values use exact data match.
- Where vs what happened. Data explorer shows where classified content is now. Activity explorer shows what people did with it over the last 30 days.
Keep Practicing for SC-900
Review identity concepts in SC-900 Questions 31-40, then continue to Questions 51-60 on sensitivity labels, DLP, retention, insider risk, eDiscovery, and audit. The official SC-900 study guide lists every skill measured.