MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  eDiscovery (Standard)

  Why this is correct

  eDiscovery (Standard) in Microsoft Purview enables legal teams to create cases and apply holds to content from Exchange Online, SharePoint Online, OneDrive, and Microsoft Teams. A hold can be scoped to a specific user or refined with a search query, preserving all matching content even if users try to edit or delete it. This case-based preservation is exactly what is needed for a legal hold, making this the correct answer.

• ✗

  Data Lifecycle Management (retention policies)

  Why it's wrong here

  Data Lifecycle Management, specifically Microsoft 365 retention policies, is designed for automating the retention and deletion of content based on age, sensitivity, or regulatory requirements. Although these policies do preserve content during a defined retention period, they are not intended for ad-hoc, case-based legal holds against a specific user; they apply broadly to all content in a location or matching a label, not a litigation event. Thus, they manage lifecycle but cannot be used to place a hold in response to a legal matter.

• ✗

  Communication Compliance

  Why it's wrong here

  Communication Compliance (formerly Supervision) is a Microsoft Purview solution for detecting policy violations such as offensive language, conflicts of interest, harassment, and unauthorized disclosure of confidential information in emails, Teams chats, and other communications. It uses trainable classifiers and policies to generate alerts and route items for review, but it does not preserve the full set of a user's data for legal hold purposes. Its role is monitoring for misconduct, not preservation of all content belonging to an individual, so it cannot satisfy a legal hold requirement.

• ✗

  Audit log

  Why it's wrong here

  The Microsoft 365 audit log records events such as who accessed, modified, or deleted items in Exchange, SharePoint, and other workloads, providing a trail of activity for security and compliance investigations. However, it captures metadata about actions, not the underlying content, and it does not place any hold on a user's data to prevent its modification or deletion. Even if an audit log shows a deletion, it cannot preserve the deleted content, so it is not a mechanism for enforcing a legal hold.

Go deeper

Related to this question