MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A legal team needs to preserve all data related to a specific user involved in litigation, including Exchange emails, SharePoint documents, OneDrive files, and Teams chats. They require a hold that cannot be removed by the user and must allow for later searching and export. Which Microsoft Purview solution should they use?
⚠ Common exam trap
Watch out — candidates often confuse retention policies with litigation holds, not realizing that retention policies are scheduled and policy-based, whereas eDiscovery holds are user-specific, immediate, and designed for legal preservation with full search and export capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
eDiscovery (Standard)
eDiscovery (Standard) is the correct solution because it allows legal teams to place a hold on all content relevant to a specific user, including Exchange emails, SharePoint documents, OneDrive files, and Teams chats. This hold is enforced at the service level, preventing the user from deleting or modifying the data, and it preserves the content in its original location for later searching and export via Content Search or eDiscovery export tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
eDiscovery (Standard)
Why this is correct
eDiscovery (Standard) creates a case in the Microsoft Purview compliance portal that can place an in-place Litigation Hold on Exchange mailboxes, SharePoint sites, OneDrive accounts, and Teams. With query-based holds, it preserves any content matching the case-specific search criteria, and it automatically retains copies of items that users try to edit or delete. The hold freezes content indefinitely until the legal team removes it, and the tool also provides comprehensive search and export capabilities for the preserved data.
- ✗
Retention policies
Why it's wrong here
Retention policies are proactive, organization-wide rules that dictate how long content is kept and when it is permanently deleted, based on business or regulatory requirements. They are not designed for ad-hoc legal actions: if a policy's retention period expires, content will be purged even if a case is active. A specific litigation hold cannot be applied by a retention policy, because it cannot be targeted to a named case or to the exact evidence required for preservation.
- ✗
Communication Compliance
Why it's wrong here
Communication Compliance is a supervision-focused solution that monitors emails and Microsoft Teams messages to detect workplace policy violations such as harassment, threats, or unauthorized confidential disclosures. When a violation is found, it triggers alerts and allows reviewers to escalate or remediate; it does not, however, place any hold on data or prevent its manual or automatic deletion. Because it only inspects content for policy issues, it has no mechanism to guarantee preservation of all data tied to a legal subpoena.
- ✗
Data Loss Prevention (DLP)
Why it's wrong here
Data Loss Prevention (DLP) applies security policies to inspect email, documents, and other content for sensitive information such as credit card numbers, bank accounts, or health records, and then takes protective actions like blocking transmission or encrypting the file. While DLP can log incidents and even prevent external sharing, it does not create a legal hold, does not snapshot content, and does not stop a user from deleting a file or a system lifecycle job from purging it. Its goal is to stop data from leaving, not to preserve data that already exists for litigation.
Go deeper
Related to this question
Learn chapter
External Sharing in SharePoint and OneDrive
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
eDiscovery
eDiscovery is the process of identifying, collecting, and producing electronic information for legal cases or investigations.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.