MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A compliance officer at Fabrikam needs to ensure that all Microsoft 365 data is retained for exactly 7 years and then permanently deleted, regardless of user actions. Which Microsoft 365 capability should the officer use?
⚠ Common exam trap
The trap here is assuming that any hold or retention feature will automatically delete data after a period, when many holds only preserve data indefinitely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Retention policies in Microsoft Purview
Retention policies in Microsoft Purview are specifically designed to manage the lifecycle of content across Microsoft 365 services. They can retain content for a defined period and then delete it, ensuring compliance with regulations that require both retention and eventual disposal. This makes retention policies the correct tool for the stated requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Litigation Hold in Exchange Online
Why it's wrong here
Litigation Hold in Exchange Online is used to preserve mailbox content indefinitely or for a specified duration when there is a legal case. However, it does not automatically delete content after the retention period ends; it only preserves it. Therefore, it does not meet the requirement to permanently delete data after 7 years.
- ✓
Retention policies in Microsoft Purview
Why this is correct
Retention policies in Microsoft Purview allow organizations to retain or delete content across Microsoft 365 workloads based on a specified duration. They can be applied to Exchange Online, SharePoint Online, OneDrive, Teams, and more. This capability ensures data is kept for the required period and then permanently deleted, meeting the compliance requirement.
- ✗
Microsoft 365 Backup
Why it's wrong here
Microsoft 365 Backup is a service that provides backup and restore capabilities for Exchange Online, SharePoint, and OneDrive. It is focused on data protection and recovery, not on compliance retention or deletion. It does not enforce retention periods or automatically delete data after a specified time.
- ✗
Data Loss Prevention policies in Microsoft Purview
Why it's wrong here
Data Loss Prevention policies are designed to prevent sharing of sensitive information, not to manage retention or deletion of data over time. They can block or audit actions on content containing sensitive data, but they do not enforce retention periods or automatic deletion after a set time.
Go deeper
Related to this question
Learn chapter
Retention Labels and Compliance
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.