Describe security, compliance, privacy, and trust in Microsoft 365 →mediumMultiple ChoiceObjective-mapped

MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

A compliance officer needs to automatically retain all SharePoint documents that contain a specific project code for exactly 5 years. The retention must be applied automatically when the document is uploaded, without any user interaction. Which Microsoft Purview feature should they configure?

⚠ Common exam trap

A common mix-up: candidates confuse retention labels (which enforce retention actions) with sensitivity labels (which focus on classification and protection), leading them to choose Option B when the requirement is purely about automated retention duration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Retention labels with an auto-apply policy

Retention labels with an auto-apply policy are the correct choice because they allow you to automatically assign a retention label to SharePoint documents based on specific conditions, such as the presence of a project code, and enforce a fixed retention period (e.g., 5 years) without any user interaction. This feature is designed for automated, policy-driven retention based on content properties or sensitive information types.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Data Loss Prevention (DLP) policy
Why it's wrong here
Data Loss Prevention (DLP) policies scan content to detect sensitive data and apply protective actions such as blocking sharing, showing policy tips, or encrypting email—but they do not manage how long content is retained. DLP rules are reactive controls against data leakage and lack any retention timer or disposition action. Automatically retaining documents based on keywords requires a retention label with an auto-apply policy, not a DLP policy.
✗
Sensitivity labels
Why it's wrong here
Sensitivity labels enforce classification, encryption, and visual marking so that only authorized users can access content, and they can be assigned manually or via auto-labeling methods. However, a sensitivity label has no retention period setting; its scope is protection and governance, not lifespan. Retention timing is the exclusive domain of retention labels, which can be auto-applied via similar detection rules but produce retention outcomes instead of permission changes.
✓
Retention labels with an auto-apply policy
Why this is correct
Retention labels with an auto-apply policy are purpose-built for this scenario: a Microsoft Purview auto-label policy runs a query to match keywords, sensitive info types, or trainable classifiers, and automatically assigns the retention label to each matching item. The label then enforces the configured retention period and disposition action—such as delete after 7 years or keep forever—without requiring any user effort. This content-triggered, hands-free lifecycle management makes it the only option that fully satisfies the compliance officer's need for automatic retention.
✗
eDiscovery (Premium)
Why it's wrong here
eDiscovery (Premium) is a search, hold, and export tool used during litigation or regulatory investigations, not a proactive retention mechanism. It requires manual creation of a legal hold against specific custodians or locations, and that hold only freezes content while the case is active, with no rule-based or keyword-driven automation. Consequently, it cannot automatically retain all documents based on content criteria, and it depends on human setup for each individual matter.

Go deeper

MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Why each option matters

Option-by-option breakdown

Related to this question