Manage compliance by using Microsoft Purview →mediumMultiple ChoiceObjective-mapped

MS-102 Manage compliance by using Microsoft Purview Practice Question

A legal department needs to preserve all communications related to an ongoing lawsuit. They identify specific users and require that their mailbox items and OneDrive files are not altered or deleted. Which Microsoft Purview feature should be used?

⚠ Common exam trap

Candidates often confuse retention policies with litigation holds, thinking retention policies can preserve data indefinitely, but retention policies allow deletion after the retention period and do not block user-initiated edits or deletions during the policy's active duration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Litigation Hold

Litigation Hold is the correct feature because it preserves all mailbox items and OneDrive files for specific users in their current state, preventing any alteration or deletion by users or automated processes. This is essential for legal holds where data must be immutable for eDiscovery purposes, and it applies at the user level rather than broadly across the organization.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Litigation Hold
Why this is correct
Litigation Hold is the correct mechanism because it places a preservation hold on an entire mailbox and OneDrive for Business site in-place, preventing items from being permanently deleted or altered. Every version of a document and every mailbox item, including deleted items and items edited by users, is retained in the Recoverable Items folder until the hold is released. Deletion by users, as well as cleanup by retention policies, is blocked for held content, ensuring all communications related to the legal matter remain discoverable in their original location.
✗
Retention Policy
Why it's wrong here
A retention policy is lifecycle-based and does not block users from deleting or changing messages and documents; it simply defines how long content is kept and when it is disposed of automatically. When a user deletes an item subject to a retention policy, the item may be retained in the Recoverable Items folder for the configured period, but the visible deletion still occurs and content can be permanently purged after that period expires. It also normally uses a disposition review or deletion action rather than an indefinite, in-place legal hold, so it cannot satisfy a legal preservation requirement.
✗
Data Loss Prevention (DLP)
Why it's wrong here
Data Loss Prevention policies inspect content for sensitive information types such as credit card numbers or personally identifiable information and apply actions like blocking external sharing or notifying users. DLP is focused on preventing unauthorized exfiltration, not on preserving or protecting data from deletion, and it has no mechanism to retain versions of items or restore deleted communications. Even if a message triggers a DLP rule, DLP will not hold the mailbox content for legal purposes, so it fails the preservation requirement.
✗
eDiscovery
Why it's wrong here
eDiscovery is a search and export tool used to identify, review, and produce content once a legal matter exists, and running a search alone does not place a preservation hold on mailboxes or OneDrive. While an eDiscovery case can be configured with an eDiscovery hold, that requires an explicit separate step; without configuring a hold, deleted or modified items remain outside the scope of discovery. eDiscovery is therefore a downstream process for collecting evidence, whereas Litigation Hold is the preservation control that keeps evidence intact from the moment the legal duty attaches.

Go deeper

MS-102 Manage compliance by using Microsoft Purview Practice Question

Why each option matters

Option-by-option breakdown

Related to this question