SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Data Lifecycle Management (retention policies and labels)

  Why this is correct

  Data Lifecycle Management, specifically through Microsoft 365 retention policies and retention labels, is the precise solution for enforcing long-term data retention requirements. Retention policies can be applied broadly to Exchange mailboxes to ensure all customer service emails are preserved for a specified duration, such as seven years, preventing both accidental and malicious deletion by users. These policies also manage the automatic deletion of content after its retention period expires, ensuring compliance with regulatory and organizational data lifecycle mandates.

• ✗

  Communication Compliance

  Why it's wrong here

  Communication Compliance in Microsoft 365 is primarily designed to help organizations detect, investigate, and act on inappropriate or non-compliant communications within their environment. It focuses on identifying sensitive information, harassment, or regulatory violations through policies that scan messages for specific content or patterns. While it monitors communications, it does not provide the mechanisms for enforcing long-term data retention periods or managing the lifecycle of data through automated deletion, making it unsuitable for the stated requirement.

• ✗

  eDiscovery (Premium)

  Why it's wrong here

  eDiscovery (Premium) in Microsoft 365 is a specialized toolset used for identifying, preserving, collecting, processing, reviewing, and analyzing electronically stored information (ESI) for legal or investigative purposes. It enables placing legal holds on content to prevent its deletion and facilitates comprehensive searches across various data sources. However, eDiscovery is a reactive tool for specific cases, not a proactive system for establishing and enforcing an organization-wide, automated data retention and deletion schedule. It does not manage the routine lifecycle of data.

• ✗

  Data Loss Prevention (DLP)

  Why it's wrong here

  Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information from being inadvertently or maliciously shared outside the organization or with unauthorized individuals internally. DLP focuses on preventing data exfiltration or inappropriate access by detecting sensitive data types and enforcing actions like blocking, auditing, or encrypting. While crucial for data security, DLP policies do not offer any functionality for defining, enforcing, or managing the long-term retention periods or automated deletion of data within an organization's systems.