SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company must retain all financial records for exactly 7 years and then automatically delete them. They need to automatically apply a retention label to any document that contains the words 'Invoice' or 'Statement'. Which Microsoft Purview solution should they use?
⚠ Common exam trap
Test-takers frequently confuse Data Lifecycle Management (which handles retention and deletion) with Data Loss Prevention (which handles security and access control), because both involve 'labels' and 'policies' in Microsoft Purview.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Lifecycle Management (retention labels with auto-apply)
Data Lifecycle Management (DLM) with auto-apply retention labels is the correct solution because it allows you to define a retention label that automatically applies to documents containing the keywords 'Invoice' or 'Statement' using a sensitive info type or trainable classifier. You can then configure the label to retain the data for exactly 7 years and trigger automatic deletion at the end of that period. This directly meets the requirement for both automated classification and lifecycle enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Lifecycle Management (retention labels with auto-apply)
Why this is correct
Data Lifecycle Management, specifically through retention labels with auto-apply policies, is the precise solution. These labels can be configured to automatically identify financial records using keywords, sensitive information types, or specific content properties. Once applied, the label enforces a precise retention period, such as seven years, ensuring the content is preserved for the required duration and then automatically deleted, fulfilling both retention and deletion obligations for compliance.
- ✗
Data Loss Prevention (DLP)
Why it's wrong here
Data Loss Prevention (DLP) policies are designed to identify, monitor, and protect sensitive information from unauthorized sharing or transfer outside the organization. While DLP can detect financial records, its primary function is to prevent data exfiltration or inappropriate use, not to manage the lifecycle of content by enforcing specific retention periods or automated deletion. Therefore, DLP cannot fulfill the requirement to retain records for exactly seven years.
- ✗
eDiscovery (Standard)
Why it's wrong here
eDiscovery (Standard) is a tool primarily used for identifying, preserving, collecting, and exporting electronic data in response to legal or investigative requests. While it can place content on legal hold to prevent deletion, it does not provide mechanisms to automatically apply retention labels based on content type or enforce a scheduled, fixed-term retention and subsequent deletion policy. It's reactive for specific cases, not proactive for ongoing data lifecycle management.
- ✗
Audit
Why it's wrong here
The Audit solution in Microsoft 365 records user and administrator activities across various services, providing a forensic trail for security, compliance, and investigative purposes. It generates logs detailing who did what, when, and where. However, auditing is a logging and reporting mechanism; it does not possess the functionality to apply retention labels, enforce retention periods, or automate the deletion of content based on predefined policies.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Labels
Labels are descriptive text or tags attached to IT resources to organize, identify, and manage them based on attributes like purpose, environment, or owner.
Key term
Data lifecycle management
Data lifecycle management is the process of managing data from its creation to its deletion, ensuring it is stored, used, and disposed of in a way that meets security, compliance, and business needs.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.