SC-100 Practice Question: Design security operations, identity, and compliance capabilities
You are designing a Microsoft Purview solution for a healthcare organization that must retain electronic protected health information for seven years and ensure that when a custodian leaves the company, their mailbox content remains discoverable. The organization also wants to prevent users from permanently deleting content that is under retention. Which Microsoft Purview feature should you use?
⚠ Common exam trap
The trap here is treating sensitivity labels or DLP as retention controls, when only retention labels and policies keep content and preserve inactive mailboxes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Retention labels published to Exchange mailboxes with a retention period and a retention policy for the workload
The scenario requires three things: a seven-year retention period, preservation of a departed custodian's mailbox, and prevention of permanent deletion. Retention labels and retention policies in Microsoft Purview deliver all three, because items under retention cannot be permanently removed and a mailbox under retention becomes inactive when the user account is deleted. The other features address confidentiality, exfiltration, or message review rather than retention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sensitivity labels with encryption applied to all email containing patient data
Why it's wrong here
Sensitivity labels with encryption protect content confidentiality and can restrict who can open or forward an item, but they do not define a seven-year retention period and do not preserve a departed custodian's mailbox. Encryption also does not prevent a user with rights from deleting an item, so it addresses a different risk than retention and preservation.
- ✓
Retention labels published to Exchange mailboxes with a retention period and a retention policy for the workload
Why this is correct
Retention labels and retention policies in Microsoft Purview can keep Exchange mailbox content for a defined period and preserve it when a user leaves by converting the mailbox to an inactive mailbox if the hold is applied. Retention also blocks permanent deletion of items that are still within the retention period, which satisfies the preservation requirement across the seven-year window.
- ✗
Data Loss Prevention policies that block sharing of patient records externally
Why it's wrong here
DLP policies detect and block or warn on sharing of sensitive content in locations such as Exchange, SharePoint, and Teams. They are preventive controls for exfiltration, not retention controls. They do not keep content for seven years, do not create inactive mailboxes, and do not stop a user from deleting an item that should be preserved.
- ✗
Communication compliance policies that review messages for inappropriate content
Why it's wrong here
Communication compliance captures and reviews messages for policy violations such as harassment or regulatory breaches. It supports supervision workflows and reviewer assignment, but it does not impose a retention schedule, does not preserve departed users' mailboxes, and does not prevent permanent deletion of retained items. It is a monitoring control, not a retention control.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 605-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.