Manage compliance by using Microsoft Purview →hardMultiple Choice

MS-102 Manage compliance by using Microsoft Purview Practice Question

You are the compliance administrator for Contoso Ltd., a multinational corporation with 10,000 users. The company uses Microsoft 365 E5 licenses and has deployed Microsoft Purview. The legal department requires that all email communications related to ongoing litigation be preserved for the duration of the case. You have identified the custodians and relevant keywords. You need to ensure that all relevant emails are preserved, regardless of whether users delete them. Additionally, you need to allow authorized reviewers to search and export the preserved emails without affecting the original data. Finally, you must ensure that the preservation is lifted automatically when the case is closed. What should you do?

⚠ Common exam trap

MS-102 often tests the distinction between retention labels, DLP, and eDiscovery holds, tricking candidates into choosing a retention label because it sounds like 'preservation' when the scenario actually requires case-based legal hold with automatic release.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an eDiscovery (Premium) case, add custodians, place them on hold, and use the case to search and export. Close the case to release the hold.

eDiscovery (Premium) cases in Microsoft Purview are purpose-built for litigation workflows: they let you add custodians, place them on legal hold, run targeted searches, and export results without altering the source data. Closing the case automatically releases the custodian holds, which satisfies the requirement that preservation be lifted when the case ends. This is the only option that combines custodian-scoped preservation, reviewer search/export, and automatic hold release in one workflow.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Create an eDiscovery (Premium) case, add custodians, place them on hold, and use the case to search and export. Close the case to release the hold.
Why this is correct
eDiscovery (Premium) is the correct solution because it provides a centralized case object that ties together custodians, holds, searches, and exports. Adding custodians places them on hold, ensuring their data is preserved across Exchange, SharePoint, and OneDrive for Business, while the case interface enables targeted searching and exporting. Closing the case (with release hold option) cleanly removes the holds, and the case record preserves an audit trail of the investigation.
✗
Configure a DLP policy to protect sensitive data and preserve the emails.
Why it's wrong here
A DLP policy is designed to detect and protect sensitive data (e.g., PII, credit cards) from being shared inappropriately; it does not preserve or hold content for legal purposes. DLP actions include blocking or alerting, but they do not place a legal hold on mailboxes or files, and DLP has no concept of a case or custodians. Relying on DLP for preservation leaves content vulnerable to deletion and offers no discovery search/export functionality.
✗
Create a retention label with a preservation action and publish it to the entire organization.
Why it's wrong here
A retention label with a preservation action, published organization-wide, applies a broad, time-based retention rule to every item, rather than a targeted hold on specific custodians or content. This overretains all data indefinitely or until expiration, which contradicts the principle of minimizing held content for a specific matter. Additionally, it is not associated with an eDiscovery case, so it lacks the search, hold-release, and export workflow required for compliance investigations.
✗
Place an in-place hold on all mailboxes using the Exchange admin center.
Why it's wrong here
Using the Exchange admin center to place an in-place hold on all mailboxes is a legacy, non-case-oriented approach that forces a blanket hold without the ability to scope by custodian or refine the preserved items. Such holds must be manually removed when the matter concludes, and they are not integrated with the eDiscovery (Premium) case lifecycle. This method also prevents you from leveraging case-based search and export, making it unsuitable for a structured legal investigation.

Go deeper

MS-102 Manage compliance by using Microsoft Purview Practice Question

Why each option matters

Option-by-option breakdown

Related to this question