MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Retention policies

  Why this is correct

  Retention policies in Microsoft Purview are the primary mechanism for automatically enforcing GDPR's storage-limitation obligations. They can be configured to retain personal data for a defined period and then permanently delete it, operating consistently across Exchange, SharePoint, OneDrive, and Teams. By allowing you to set precise retention and deletion rules based on content age or sensitive data types, they directly satisfy data-minimization and erasure requirements without manual intervention. This makes them the correct answer for meeting GDPR retention and deletion obligations.

• ✗

  Data Lifecycle Management (via sensitivity labels)

  Why it's wrong here

  Data Lifecycle Management is a feature of Microsoft Purview that uses retention labels and auto-labeling policies to classify and manage data, but it is not a complete substitute for retention policies. While sensitivity labels can trigger retention actions, they also apply encryption, access control, and visual markings — none of which directly enforce automated deletion. Configuring Data Lifecycle Management requires per-label policies and does not provide the same breadth of automatic, workload-wide retention and deletion as retention policies. Therefore, while it assists in lifecycle management, it is not the primary solution required for GDPR compliance.

• ✓

  eDiscovery (Premium)

  Why this is correct

  eDiscovery (Premium) is the correct tool for fulfilling data subject access requests (DSARs) under GDPR Article 15 because it allows you to search, preserve, and export personal data from multiple Microsoft 365 workloads. It supports full-text search, advanced indexing, and legal hold capabilities, enabling you to locate all relevant data about an individual and produce it within the GDPR's one-month timeframe. Unlike retention policies, it does not enforce automated deletion but rather provides the discovery and export functionality necessary to respond to access requests. This is essential for GDPR compliance, making eDiscovery (Premium) correct in its role.

• ✗

  Audit (Standard)

  Why it's wrong here

  Audit (Standard) in Microsoft Purview records user and admin activity, such as document view, edit, and send events, but it only captures metadata about 'who did what, when, and where.' It does not allow searching the actual content of personal data, nor does it provide the ability to export that content to fulfill a DSAR. While audit logs are useful for demonstrating compliance and investigating security events, they cannot meet GDPR obligations for data access or deletion. Thus, relying on Audit (Standard) alone would fail to address GDPR requirements, making it incorrect for this purpose.

Go deeper

Related to this question