MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create a retention policy → Select locations → Configure retention settings → Publish the policy

  Why this is correct

  Creating the retention policy is the initial step in the Microsoft Purview compliance portal because it establishes the policy object that will contain the scope and rules. After the policy is initialized, you add locations (Exchange mailboxes, SharePoint sites, OneDrive accounts, Microsoft 365 Groups, and Teams) to define what content is covered. Then you configure the retention settings — whether to retain, delete, or retain-and-delete and for how long — before publishing, which saves and enforces the policy across the selected locations. This order mirrors the wizard's progression and ensures a complete, valid policy is activated.

• ✗

  Select locations → Create a retention policy → Configure retention settings → Publish the policy

  Why it's wrong here

  Selecting locations before creating a retention policy is technically impossible because the location pickers in the Microsoft Purview portal are part of the policy-creation wizard and require an existing policy object to bind the scope. Without a policy, there is no container to store which mailboxes or sites are included; the scope is defined as an attribute of the policy, so you must create the policy first. Attempting to choose locations first would leave the selections unbound, and the portal does not expose a location picker outside the policy workflow.

• ✗

  Configure retention settings → Create a retention policy → Select locations → Publish the policy

  Why it's wrong here

  Configuring retention settings before the policy exists is invalid because retention actions, retention periods, and the decision to retain, delete, or both are stored in a retention rule that is defined on the policy. In the wizard, the settings step appears only after the policy is created and locations are selected; in PowerShell, you must run New-RetentionCompliancePolicy before New-RetentionComplianceRule. Defining settings first would have no policy object to attach the rule to, so the settings cannot be created or persisted until the policy exists.

• ✗

  Create a retention policy → Publish the policy → Select locations → Configure retention settings

  Why it's wrong here

  Publishing the policy before selecting locations and configuring retention settings is a logical error because 'publish' in the compliance portal finalizes and applies the policy to the content you selected. If you published an empty policy, you would be activating a policy with no scope or retention rules, which Microsoft 365 will not allow; the wizard blocks the final confirmation until locations and settings are specified. Even if you later edit the policy to add them, the initial publication would not have the intended compliance coverage, so the correct sequence is to define everything before the final publish step.

Go deeper

Related to this question