Design security operations, identity, and compliance capabilities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
You are designing a compliance solution for your organization that must enforce retention policies for documents stored in SharePoint Online. Which Microsoft Purview solution should you use?
⚠ Common exam trap
A common mix-up: candidates confuse 'retention' with 'eDiscovery holds' or 'compliance monitoring,' leading them to select eDiscovery or Communication Compliance, but Data Lifecycle Management is the only solution that directly enforces retention schedules for content in SharePoint Online.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Lifecycle Management
Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it is specifically designed to enforce retention policies for documents in SharePoint Online. It allows you to apply retention labels and policies that automatically retain or delete content based on compliance requirements, without user intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Data Lifecycle Management
Why this is correct
Data Lifecycle Management is the dedicated service for enforcing retention and deletion policies across Microsoft 365 workloads. It provides retention labels and policies that let you preserve content for a specified period, then automatically dispose of it, optionally with disposition review. This directly addresses compliance needs for record keeping, regulatory retention, and data minimization. Other services lack the policy-driven automation that DLM offers for lifecycle control.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
eDiscovery is built for legal and investigative scenarios: it searches, collects, and exports potentially relevant content, often placing it on legal hold to prevent deletion. That legal-hold functionality actively preserves data, opposing the automated deletion goals of a compliance solution for lifecycle management. While it can aid in reviewing data for retention decisions, it does not implement retention schedules or manage disposition. Its core purpose is content discovery, not enforcing retention or deletion.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Communication Compliance focuses on monitoring and analyzing communications, such as emails and Microsoft Teams messages, to detect policy violations like offensive language, conflicts of interest, or regulatory non-compliance. It inspects message content and triggers alerts for review, but it has no mechanism to define retention periods, apply retention labels, or execute deletion workflows. Its scope is surveillance and detection, not data lifecycle administration. Therefore, it fails to address the retention and deletion compliance requirement.
- ✗
Microsoft Purview Insider Risk Management
Why it's wrong here
Insider Risk Management is aimed at identifying and mitigating risky user activities, such as data exfiltration, unauthorized access, or security breaches, through behavioral analytics and investigation workflows. It generates alerts about potential insider threats and provides evidence for security teams, but it does not manage how long content is kept or when it is disposed. Its focus is user behavior and threat response, not the automated enforcement of retention policies or data deletion. Consequently, it is unsuitable for a compliance solution centered on content lifecycle.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.