Describe security, compliance, privacy, and trust in Microsoft 365 →mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A legal team is involved in a court case and needs to identify all emails and documents related to a specific project across the entire organization. They need to place these items on hold to prevent deletion or modification. Which Microsoft Purview solution should they use?
⚠ Common exam trap
It's easy for candidates to confuse eDiscovery with Audit, thinking that logging all activities (Audit) is sufficient for legal holds, but Audit only records events and cannot preserve or search content for litigation purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
eDiscovery (Standard)
EDiscovery (Standard), is correct because it is specifically designed for legal discovery processes, allowing authorized users to search for content across Exchange Online, SharePoint Online, OneDrive for Business, and Teams. It can place a legal hold on identified items to preserve them from deletion or modification, which directly meets the legal team's requirement to identify and hold all emails and documents related to a specific project.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Loss Prevention (DLP)
Why it's wrong here
Data Loss Prevention (DLP) policies operate on endpoint and cloud traffic to detect sensitive information types—such as credit card numbers or personally identifiable information—and enforce actions like blocking access or encrypting files. Unlike eDiscovery, DLP lacks a content search engine over all Microsoft 365 workloads and cannot apply a legal hold to preserve items pending litigation. It is a preventive control, not an investigative or preservation mechanism.
- ✓
eDiscovery (Standard)
Why this is correct
eDiscovery (Standard) is the native Microsoft 365 solution for legal discovery, enabling keyword and metadata searches across Exchange Online, SharePoint Online, OneDrive for Business, and Teams content. It supports placing non-custodial and custodial holds to preserve in-place content from deletion, and its export function packages the search results and metadata for review. This aligns exactly with the legal team's need to identify and preserve relevant information for the court case.
- ✗
Audit (Standard)
Why it's wrong here
Audit (Standard) records actions like user sign-ins, file accesses, mailbox operations, and admin changes in the unified audit log, which is useful for security forensics and compliance investigation. However, it does not index or surface the content of documents or messages, and it cannot freeze a mailbox or site against purging. Consequently, it provides activity trails rather than the actual evidence content or hold capabilities that eDiscovery delivers.
- ✗
Communication Compliance
Why it's wrong here
Communication Compliance applies configurable policies to scan channels like Microsoft Teams, Exchange, and Yammer for behaviors such as harassment or regulatory violations, using text classifiers to flag problematic messages. It is designed to monitor behavior and trigger remediation workflows, but it does not offer a general search across all organizational content or a legal hold feature. Thus it cannot be used to identify all evidence relevant to the court case.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
OneDrive for Business
OneDrive for Business is a cloud-based file storage and synchronization service from Microsoft, part of Microsoft 365, that lets users store, access, and share work files securely from anywhere.
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.