A company is considering using Microsoft 365 and wants to understand what data Microsoft collects and how it is used. The compliance team needs a single source of truth that explains Microsoft's data practices in plain language. What should they review?

The Microsoft Trust Center's security whitepapers

The Microsoft Privacy Statement

The Service Trust Portal's Compliance Manager

What is the primary purpose of the Microsoft Service Trust Portal?

To provide a centralized location for accessing Microsoft's compliance and security documentation, audit reports, and certifications.

To allow users to manage their personal data and privacy settings across Microsoft services.

To provide a platform for submitting support tickets and tracking service incidents.

To offer a marketplace for purchasing Microsoft cloud services and licenses.

A software company is designing a new telemetry feature for its application. The design team proposes collecting user IP addresses, device IDs, and detailed usage logs. The privacy officer insists on data minimization. The team argues that all data is needed for troubleshooting. What is the best way to satisfy both the feature's needs and the data minimization principle?

Collect only the data necessary for troubleshooting and define a retention period.

Collect all proposed data and store it indefinitely for future analysis.

Collect no data to avoid any privacy risk.

Collect all proposed data but pseudonymize it before storage.

A multinational company is concerned about the physical security of data centers that host their Microsoft 365 data. They want to verify that Microsoft has independent third-party audits of its data center security controls. What should they review on the Service Trust Portal?

The Microsoft Privacy Statement

The Compliance Manager dashboard

The Data Protection Impact Assessment (DPIA)

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 4Objective 1

Describe Microsoft Service Trust Portal and Privacy Principles SC-900 Practice Questions (Page 10)

Part of the Describe the capabilities of Microsoft compliance solutions domain, which accounts for 20–25% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~4–8 in this domain), expect 1–2 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

9concepts

20–25%of the exam

Questions 46–50

46application · medium
A company is considering using Microsoft 365 and wants to understand what data Microsoft collects and how it is used. The compliance team needs a single source of truth that explains Microsoft's data practices in plain language. What should they review?
Select an answer first
47application · easy
A security engineer is reviewing Microsoft's security safeguards for customer data. The engineer wants to find detailed information about how Microsoft protects data at rest and in transit, including encryption key management. Which resource on the Service Trust Portal should the engineer consult?
Select an answer first
48foundation · easy
What is the primary purpose of the Microsoft Service Trust Portal?
Select an answer first
49expert · hard
A software company is designing a new telemetry feature for its application. The design team proposes collecting user IP addresses, device IDs, and detailed usage logs. The privacy officer insists on data minimization. The team argues that all data is needed for troubleshooting. What is the best way to satisfy both the feature's needs and the data minimization principle?
Select an answer first
50application · medium
A multinational company is concerned about the physical security of data centers that host their Microsoft 365 data. They want to verify that Microsoft has independent third-party audits of its data center security controls. What should they review on the Service Trust Portal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.

Describe Microsoft Service Trust Portal and Privacy Principles SC-900 Practice Questions (Page 10)

Questions 46–50

A company is considering using Microsoft 365 and wants to understand what data Microsoft collects and how it is used. The compliance team needs a single source of truth that explains Microsoft's data practices in plain language. What should they review?

A security engineer is reviewing Microsoft's security safeguards for customer data. The engineer wants to find detailed information about how Microsoft protects data at rest and in transit, including encryption key management. Which resource on the Service Trust Portal should the engineer consult?

What is the primary purpose of the Microsoft Service Trust Portal?

A multinational company is concerned about the physical security of data centers that host their Microsoft 365 data. They want to verify that Microsoft has independent third-party audits of its data center security controls. What should they review on the Service Trust Portal?

Keep studying — Describe the capabilities of Microsoft compliance solutions