A social services casework office distinguishes DLP alerts from Communication Compliance conduct alerts. What distinction is correct?

Social services casework should distinguish that DLP alerts focus on sensitive data protection matches, while Communication Compliance focuses on risky or inappropriate communications. Both are Microsoft Purview alerting lanes, but one guards sensitive information movement/matches (SSNs, health data, financial identifiers) and the other monitors communications for conduct policy issues (harassment, threats, inappropriate workplace language). Correct triage depends on knowing which alert type you received.

Claiming DLP alerts track insider risk scoring trends while Communication Compliance enforces retention label deletion schedules fails role boundaries: insider risk scoring belongs to Insider Risk Management, and retention/deletion scheduling is records management, not these alert lanes. Claiming DLP alerts review Teams message conduct for harassment signals while Communication Compliance blocks external sharing of sensitive data types swaps the lanes: DLP guards sensitive data matches, not conduct review, and Communication Compliance monitors conduct, not external sharing blocks. Claiming DLP alerts support eDiscovery hold notifications while Communication Compliance applies sensitivity labels to case files misassigns capabilities: eDiscovery holds and sensitivity labeling are separate Purview functions, not the purpose of these alerts.

Exam caveat: AB-900 loves Purview tool contrasts. Memorize DLP → sensitive data matches; Communication Compliance → risky/inappropriate communications. Insider Risk Management is a third lane (risky user activities) you should not collapse into these two.

Operational check: In casework onboarding, show one sample DLP alert (sensitive data) and one sample Communication Compliance alert (conduct), confirm separate response owners if required by policy, and verify staff do not close a conduct finding by confusing it with insider risk scoring trends or retention-label deletion schedules.