An original SC-900 foundation guide for choosing the next justified action from security and compliance evidence. It compares different evidence objects without pretending that one portal replaces every control or reviewer.
Start with the decision and its owner
A security dashboard can contain many observations while leaving the next decision unclear. Start by naming what must be decided, who is responsible, which resource or data is in scope, and what evidence could change that decision. In a fictional nonprofit, one owner approves access exceptions, an analyst investigates an unusual sign-in, and a data steward checks where sensitive documents are located. Those are related activities, yet they require different evidence and authority. A product label alone does not transfer responsibility between them. Governance supplies accountability and decision processes; risk management considers uncertainty and impact; compliance evaluates relevant obligations. This guide classifies these roles conceptually and does not issue legal advice or a compliance certification.
Read a posture recommendation as a scoped finding
A posture assessment compares resources with a stated security baseline and can surface recommendations. That is useful evidence of a configuration gap or an opportunity to harden the environment. It does not establish that an attacker has already exploited the gap, and it does not prove that every recommended action has been applied. Suppose a fictional team sees a recommendation concerning a workload configuration. Its owner should inspect the affected scope, understand the condition being assessed, choose an appropriate remediation and verify the resulting state. Closing a screen or acknowledging an alert is not the same as changing the configuration. The control purpose, actual resource state and authorized action must remain visible throughout the reasoning.
Distinguish an incident signal from threat context
Security signals and correlated incidents can help an analyst investigate activity affecting an organization. Threat intelligence contributes contextual knowledge about threats, actors, indicators and infrastructure. An indicator resembling something in a local log can justify further investigation, but the resemblance alone is not a final verdict of compromise. In a fictional case, an analyst finds a domain in a threat-intelligence report and then checks whether an observed connection reached that domain, from which device, at what time and under what surrounding activity. The organization still needs an evidence-supported judgment about the local event. A threat report does not itself prove that a specific account performed an action, and reading it does not automatically isolate a device.
Choose the portal by the work it supports
The Microsoft Defender portal supports integrated security investigation experiences, while Microsoft Purview brings together data security, governance and compliance solution experiences. Their purposes overlap at the level of protecting an organization, but that does not make every control interchangeable. An investigator following correlated security activity needs the relevant incident and signal context. A steward reviewing sensitive content or a compliance workflow needs the appropriate Purview experience and permissions. Do not select a portal merely because it is the most familiar screen or because both names appeared in the same study guide. Product experiences and licensing can evolve, so this lesson teaches the conceptual work and evidence boundary rather than an unverified sequence of clicks in a tenant.
Separate content location from recorded activity
Content explorer helps examine classified content and sensitive-information locations under the applicable access permissions. Activity explorer provides a historical view of activities associated with labeled content; it is not a real-time view. Consider a fictional steward asking two questions: where relevant documents appear in the latest available reported snapshot, and what labeling actions were recorded during an investigation period. These are not the same query. A location-oriented view does not by itself reconstruct every earlier change. An activity-oriented view is limited by the supported activities, available records and the selected time and scope. Absence from a view should prompt checks of permissions, coverage, timing and filters before concluding that no relevant document or action exists.
Build a reviewable evidence-to-action chain
Write a short chain for each case: observation, scope, supported inference, uncertainty, owner, proposed action and verification. For the nonprofit, a configuration recommendation might lead to a controlled remediation task; a threat-context match might lead to an analyst investigation; a content-location result might lead to a data-handling review. None of these automatically authorizes every other action. A good explanation also names the strongest competing interpretation and the missing evidence that would distinguish it. If that evidence is unavailable, keep the conclusion provisional. Apply the same discipline to practice questions: explain why a plausible alternative addresses a different decision, rather than making it absurd. The linked lesson and original practice tasks provide a foundation, not a calibrated SC-900 simulation or a guarantee that an organization is secure.
Apply the guide
A recommendation shows that a fictional workload differs from its security baseline. Does that prove an attacker used the gap? What should the owner verify next?Reveal explanation
No. It supports a posture finding, not a proven incident. Verify the affected resource and baseline condition, choose an authorized remediation, then check the resulting state; investigate exploitation separately if evidence supports it.
A steward needs the latest available reported sensitive-content locations and a history of label changes. Why should one unfiltered screenshot not be treated as complete proof of both?Reveal explanation
The tasks concern different evidence objects. Use the appropriate reported content-location and historical activity views, checking permissions, supported coverage, time windows and processing delays. A missing record may reflect those limits rather than absence of content or action.
Turn the idea into practice.
Apply the rule to a new case, then explain your choice.
Practice this skillSources & authorship
Current official conceptual references support the bounded distinctions. Fictional cases and diagram are independently authored; no tenant data or official exam questions are reproduced.
Original OpenExam guide and diagram.
Independent educator review is pending. This guide is not an official exam paper or a video transcript.
Microsoft Learn: rd-sc-activityMicrosoft Learn: rd-sc-contentMicrosoft Learn: rd-sc-defenderMicrosoft Learn: rd-sc-grcMicrosoft Learn: rd-sc-postureMicrosoft Learn: rd-sc-purviewMicrosoft Learn: rd-sc-threat