Describe security, compliance, privacy, and trust in Microsoft 365 →mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A compliance officer needs to ensure that all emails and documents in Exchange Online and SharePoint are automatically retained for five years. After five years, the data should be automatically deleted. Which Microsoft Purview solution should they configure?
⚠ Common exam trap
Candidates often confuse retention policies with DLP policies, mistakenly thinking DLP can enforce time-based retention and deletion, when DLP is solely focused on preventing data loss through content inspection and action rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Retention policies
Retention policies in Microsoft Purview are designed to automatically retain data for a specified period and then delete it, meeting the compliance officer's requirement for Exchange Online and SharePoint. This solution applies at the container level (e.g., mailboxes, sites) and can enforce a five-year retention followed by automatic deletion without user intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Retention policies
Why this is correct
Retention policies in Microsoft Purview are lifecycle management rules applied to workloads such as Exchange email and SharePoint Online, enabling organizations to automatically keep content for a defined period (for example, seven years) and then trigger permanent deletion at the end of that schedule. They support adaptive and static scopes and can be complemented by retention labels for item-level control. This time-based retain-then-delete behavior directly satisfies the compliance officer's requirement.
- ✗
Data loss prevention (DLP) policies
Why it's wrong here
Data loss prevention (DLP) policies are designed to inspect email and documents for sensitive information types such as credit card numbers or personal data and then apply protective actions—blocking sharing, encryption, or notifying users. They operate in real time at the moment of use or transmission, not on a calendar-based schedule, and cannot be configured to automatically purge content after an aging period. Thus DLP prevents data exfiltration but does not manage retention or disposition of records.
- ✗
Sensitivity labels
Why it's wrong here
Sensitivity labels classify content using a hierarchy like Public, General, Confidential, and Highly Confidential, and can enforce protection through encryption, watermarks, and usage restrictions, but they carry no built-in retention window or deletion behavior. While you can publish sensitivity labels in Word, Excel, PowerPoint, and Outlook, they do not affect whether an email is retained after 30 days or destroyed after a hold period. For retention and deletion you use separate Purview retention labels and policies, so these labels do not satisfy a compliance-deletion requirement.
- ✗
eDiscovery (Standard)
Why it's wrong here
eDiscovery (Standard) is an investigation workflow used to locate, search, preserve (via legal holds), and export content in response to litigation or regulatory requests. It can preserve data indefinitely with a hold, which is the opposite of deleting on a schedule, and any deletion occurs only manually by an administrator after the case is closed. It is event-driven and manual rather than a fully automated lifecycle policy, so it cannot be the primary mechanism for routine email retention and deletion.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.