MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  eDiscovery (Standard) case hold

  Why this is correct

  eDiscovery (Standard) case hold creates a preservation hold within a Microsoft Purview eDiscovery case. It lets the legal team target a former employee's Exchange Online mailbox, OneDrive for Business, SharePoint sites, and Teams content, and all items in those locations are held in place, including metadata and versions. Because the hold is Custodian-based and applies organization-wide to the employee's data, it satisfies the requirement to preserve all data for legal proceedings.

• ✗

  Data Lifecycle Management retention policy

  Why it's wrong here

  Data Lifecycle Management retention policies enforce retention and deletion rules at a large scale, such as applying a single policy to all Exchange mailboxes or all SharePoint sites. They are not designed for targeted, custodian-specific legal holds, and a policy cannot be scoped to one user's data across multiple services without a complex custom scope that would still apply the same rules to other users. Furthermore, these policies are designed to automate disposition schedules, not to freeze data for litigation.

• ✗

  Sensitivity label with retention marking

  Why it's wrong here

  Sensitivity labels with retention markings use classification-based criteria that require each item to be labeled, either manually or via an automatic rule that scans content. It is not a blanket hold on all data belonging to a former employee because it cannot retroactively tag existing items in every location, and it does not integrate with eDiscovery cases or legal holds. A retention label preserves labeled content indefinitely, but unlabeled content remains unprotected from deletion.

• ✗

  Audit log search

  Why it's wrong here

  Audit log search in Microsoft Purview provides a record of user and administrator activities across Microsoft 365, including who accessed an item, when, and what action was performed. It does not store the content of emails, documents, or Teams messages, nor does it prevent content from being permanently deleted. Therefore, running an audit search would help after the fact to track what may have been lost, but it cannot preserve the data itself to meet a legal preservation obligation.

Go deeper

Related to this question