MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A multinational company must comply with the General Data Protection Regulation (GDPR). They need to be able to search for and delete personal data of a user upon request (right to erasure). Which Microsoft Purview solution should they use?
⚠ Common exam trap
MS-900 often tests whether candidates can match GDPR obligations to the correct Purview solution — many pick Audit or Communication Compliance because they sound compliance-related, missing that only eDiscovery supports content search and deletion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview eDiscovery (Premium)
Microsoft Purview eDiscovery (Premium) supports searching across Microsoft 365 workloads for personal data and applying holds or deletions to satisfy data subject requests, including the GDPR right to erasure. It provides case management, review sets, and the ability to purge content, which are the capabilities needed to locate and delete a user's personal data on request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview eDiscovery (Premium)
Why this is correct
eDiscovery Premium can search, collect, and export data, and supports deletion.
- ✗
Microsoft Purview Audit (Standard)
Why it's wrong here
Audit logs provide records but not search and delete capabilities.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Communication Compliance is for policy violations, not data subject requests.
- ✗
Microsoft Purview Insider Risk Management
Why it's wrong here
Insider Risk Management is for security risks, not compliance with erasure requests.
Go deeper
Related to this question
Learn chapter
Microsoft Teams Governance and Policy Management
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are the compliance officer for Fabrikam, a medium-sized company with 500 users on Microsoft 365 Business Premium. Fabrikam must comply with the California Consumer Privacy Act (CCPA). The legal team has identified that they need to be able to respond to consumer requests to delete personal data within 45 days. They also need to ensure that personal data is not retained longer than necessary. You have been asked to configure Microsoft Purview to meet these requirements. Specifically, you need to search for and delete personal data when a deletion request is received, and set up a data retention policy to automatically delete personal data after 2 years. What should you do?
medium- A.Implement auto-labeling to label personal data and configure a retention label to delete after 2 years.
- ✓ B.Use Content Search to find personal data, then use eDiscovery to delete it for deletion requests. Create a retention policy with a retention period of 2 years for all SharePoint sites and OneDrive accounts.
- C.Create a retention label that deletes data after 2 years and apply it manually to all documents containing personal data.
- D.Configure a DLP policy to block sharing of personal data and set a retention policy for 2 years.
Why B: Content Search in Microsoft Purview can locate items matching sensitive information types or keywords, and eDiscovery (or the newer eDiscovery/Content Search delete action) can remove those items to satisfy CCPA deletion requests. A retention policy applied to all SharePoint sites and OneDrive accounts with a 2-year retention period then automatically deletes personal data after the required period. This combination directly satisfies both the deletion-request and retention-limit requirements.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.