MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
Contoso has a Microsoft 365 E5 tenant. The security team needs to investigate a potential insider data exfiltration incident. They must be able to review the original content of emails and documents that a specific user accessed, and preserve that content so it cannot be altered or deleted by the user during the investigation. Which Microsoft Purview capability should they use?
⚠ Common exam trap
The trap here is assuming that audit log search or a retention label preserves content, when only an eDiscovery hold on the custodian actually prevents the user from altering or deleting the original items.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
eDiscovery (Premium) with a case hold applied to the custodian
The requirement combines two needs: review the original content a specific user accessed, and prevent that user from altering or deleting it during the investigation. eDiscovery (Premium) provides custodian-scoped holds that preserve data in place across Exchange Online, SharePoint Online, OneDrive, and Teams, while giving investigators a review set to examine the original items. Audit search, communication compliance, and records retention labels do not deliver custodian-based preservation with content review.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Communication compliance policies in Microsoft Purview
Why it's wrong here
Communication compliance is designed to detect policy violations in messages and attachments, such as harassment or sensitive information sharing. It surfaces flagged communications for review, but it is not a preservation mechanism and does not create holds on a custodian's mailbox or sites to protect original content from alteration or deletion during an investigation.
- ✗
Records management file plan with a retention label applied to the user's mailbox
Why it's wrong here
A retention label from a records management file plan can retain or delete content based on a schedule, but it is not scoped to a specific custodian or investigation. It does not provide the custodian-based hold and review workflow needed to preserve and examine the original content of a particular user's accessed emails and documents.
- ✗
Audit log search in the Microsoft Purview compliance portal
Why it's wrong here
Audit log search returns records of activities such as file accessed, downloaded, or deleted, but it does not provide the original content of the emails or documents. It also does not place any hold that prevents a user from altering or deleting data, so it cannot satisfy the requirement to review and preserve the original content during an insider investigation.
- ✓
eDiscovery (Premium) with a case hold applied to the custodian
Why this is correct
eDiscovery (Premium) supports custodian management and legal holds that preserve content in place, including email, SharePoint, OneDrive, and Teams. Applying a hold to the custodian ensures the user cannot modify or delete the preserved items while investigators review the original content, which directly satisfies the requirement to review and preserve accessed data.
Go deeper
Related to this question
Learn chapter
SharePoint as Intranet: Communication Sites
Key term
eDiscovery
eDiscovery is the process of identifying, collecting, and producing electronic information for legal cases or investigations.
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.