SC-900 · Domain 4: Describe the capabilities of Microsoft compliance solutions · 22% of the exam
Task 4.2: Describe compliance management capabilities of Microsoft Purview
The Microsoft Purview portal, Compliance Manager with its controls, assessments and improvement actions, and compliance score.
Study it
The Microsoft Purview portal, Compliance Manager and compliance score
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 2
The Microsoft Purview portal organizes its solutions by area. Which two solutions does it list under Data Security? (Choose TWO.)
AData Loss Prevention
BCompliance Manager
CeDiscovery
DData Lifecycle Management
EInsider Risk Management
Show the answer and why
AData Loss Prevention
Correct
DLP is listed under Data Security, with Information Protection and Insider Risk Management.
BCompliance Manager
Incorrect
Compliance Manager is listed under Risk & Compliance.
CeDiscovery
Incorrect
eDiscovery is listed under Risk & Compliance.
DData Lifecycle Management
Incorrect
Data Lifecycle Management is listed under Data Governance.
EInsider Risk Management
Correct
Insider Risk Management is listed under Data Security.
The Microsoft Purview portal gives access to all Purview solutions, organized as Core (Audit, Data Map, Settings, Workflows), Risk & Compliance (Communication Compliance, Compliance Manager, eDiscovery, Information Barriers, Records Management), Data Governance (Data Catalog, Data Lifecycle Management, Data Policy) and Data Security (Data Loss Prevention, Information Protection, Insider Risk Management).
In a Compliance Manager assessment, one control requires data to be encrypted at rest. Microsoft implements part of it in its cloud services, and the organization must carry out the rest itself. How does Compliance Manager classify this control?
AAs a Microsoft-managed control
BAs a shared control
CAs one of your controls
DAs an improvement action
Show the answer and why
AAs a Microsoft-managed control
Incorrect
Microsoft-managed controls are implemented by Microsoft alone, for its cloud services.
BAs a shared control
Correct
Shared controls are those whose implementation responsibility is shared by the organization and Microsoft.
CAs one of your controls
Incorrect
Customer-managed controls are implemented and managed by the organization alone.
DAs an improvement action
Incorrect
An improvement action is guidance for meeting a control, not a type of control.
A control is a requirement of a regulation, standard or policy. Compliance Manager tracks Microsoft-managed controls, which Microsoft implements for its cloud services; your controls, which the organization implements and manages; and shared controls, whose implementation is shared by the organization and Microsoft. Improvement actions give step-by-step guidance for meeting them.
A compliance team must track its progress toward a privacy regulation across Microsoft 365 and its workloads in other cloud providers. It wants a prebuilt assessment for the regulation, step-by-step improvement actions it can assign to people, and a score that shows progress. Which solution fits?
AThe regulatory compliance dashboard in Microsoft Defender for Cloud
BMicrosoft Secure Score
CThe Service Trust Portal
DMicrosoft Purview Compliance Manager
Show the answer and why
AThe regulatory compliance dashboard in Microsoft Defender for Cloud
Incorrect
Defender for Cloud assesses cloud resources against standards; it doesn't cover the organization's Microsoft 365 data protection controls.
BMicrosoft Secure Score
Incorrect
Secure Score measures security posture, not progress toward a regulation's controls.
CThe Service Trust Portal
Incorrect
The portal publishes Microsoft's own audit reports and compliance documents; it doesn't track the customer's progress.
DMicrosoft Purview Compliance Manager
Correct
Compliance Manager assesses compliance across a multicloud environment with prebuilt assessments, assignable improvement actions and a compliance score.
Microsoft Purview Compliance Manager helps organizations assess and manage compliance across their multicloud environment, including Microsoft 365 and other clouds. It provides prebuilt assessments for common regulations and standards, step-by-step improvement actions that can be assigned, and a compliance score that shows progress.
Roughly how many regulatory templates does Microsoft Purview Compliance Manager provide for creating assessments?
AAbout 10
BAbout 36
CNone, because every assessment has to be built from scratch
DOver 360
Show the answer and why
AAbout 10
Incorrect
Compliance Manager offers far more templates than that.
BAbout 36
Incorrect
The number is an order of magnitude larger.
CNone, because every assessment has to be built from scratch
Incorrect
Templates exist precisely so that assessments don't start from scratch.
DOver 360
Correct
The Regulations page lists over 360 regulatory templates from which assessments can be created.
The Regulations page in Compliance Manager lists the regulations and certifications for which it provides control-mapping templates: over 360 regulatory templates from which admins can quickly create assessments.
Why do some Compliance Manager improvement actions add more to the compliance score than others?
ABecause an action's point value depends on how many people are assigned to complete it
BBecause each action's point value depends on the potential risks involved
CBecause actions completed first are worth more
DBecause only Microsoft-managed actions earn points
Show the answer and why
ABecause an action's point value depends on how many people are assigned to complete it
Incorrect
Assignment doesn't change an action's value.
BBecause each action's point value depends on the potential risks involved
Correct
Compliance Manager awards points for completed actions, with values that reflect the risk involved.
CBecause actions completed first are worth more
Incorrect
The order of completion doesn't change point values.
DBecause only Microsoft-managed actions earn points
Incorrect
Point values reflect the risk involved, not who carries out the action.
Compliance Manager awards points for completing improvement actions that help comply with a regulation, standard or policy. Each action has a different point value, depending on the potential risks involved, so prioritizing actions with the highest impact raises the compliance score fastest.
Which two kinds of points make up the compliance score in Compliance Manager?
ASecure score points and identity secure score points
BYour points, and Microsoft-managed points for actions Microsoft has completed
CPoints for each user who completes security training, and points for each audit the company passes
DPoints from Defender for Cloud recommendations and from Sentinel incidents
Show the answer and why
ASecure score points and identity secure score points
Incorrect
Those are security posture measures from other tools.
BYour points, and Microsoft-managed points for actions Microsoft has completed
Correct
The score combines points for controls the organization implements with points for actions Microsoft completed as the provider.
CPoints for each user who completes security training, and points for each audit the company passes
Incorrect
Compliance score is calculated from improvement actions, not training or audits.
DPoints from Defender for Cloud recommendations and from Sentinel incidents
Incorrect
Neither feeds the compliance score.
Compliance score helps an organization understand its compliance posture by measuring progress with improvement actions. It consists of your points, from actions the organization completes for the controls it's responsible for, and Microsoft-managed points, from actions Microsoft has already completed on the customer's behalf as the cloud service provider.
An admin turns on a Microsoft 365 setting that an improvement action in Compliance Manager asks for. How does the action's status get updated?
AA continuous scan of the environment detects the setting and updates the status automatically
BThe admin must upload a screenshot as evidence before any status changes
CMicrosoft support updates it after a ticket is opened
DIt never changes, because improvement actions are informational only
Show the answer and why
AA continuous scan of the environment detects the setting and updates the status automatically
Correct
Compliance Manager continuously scans Microsoft 365 system settings and updates technical action status.
BThe admin must upload a screenshot as evidence before any status changes
Incorrect
Documentation can be stored on actions, but technical status is detected automatically.
CMicrosoft support updates it after a ticket is opened
Incorrect
No support ticket is involved.
DIt never changes, because improvement actions are informational only
Incorrect
Improvement actions track status and contribute points as they're completed.
Compliance Manager continuously assesses controls by scanning the Microsoft 365 environment and detecting system settings, continuously and automatically updating the status of technical improvement actions. Admins can also assign actions, store documentation and notes, and record status updates.