SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company must retain all HR documents stored in SharePoint Online for exactly 7 years. After 7 years, the documents must be automatically deleted. Additionally, employees must not be able to permanently delete these documents before the retention period ends. Which Microsoft Purview solution should they configure?
⚠ Common exam trap
Many candidates confuse Records Management with Data Lifecycle Management, assuming that 'records' automatically implies retention and deletion, but Records Management focuses on declaring records and managing disposition reviews, not automatic time-based deletion without user intervention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Lifecycle Management
Data Lifecycle Management (DLM) in Microsoft Purview is designed to retain content for a specified period and then automatically delete it. By applying a retention policy with a 7-year retention period and a deletion action at the end, DLM ensures HR documents are kept exactly as required. Additionally, DLM prevents users from permanently deleting documents during the retention period by locking the retention settings, which overrides user delete permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Lifecycle Management
Why this is correct
Data Lifecycle Management (DLM) in Microsoft Purview is the correct solution for managing HR documents. It allows the creation of retention labels and policies that automatically retain content for a specified period, preventing premature deletion or modification by users. Once the retention period expires, these policies can then automatically initiate the deletion of the content, ensuring compliance with data retention schedules and organizational policies.
- ✗
Records Management
Why it's wrong here
Records Management is primarily used to declare documents as permanent, immutable records, often for long-term legal or regulatory compliance where indefinite preservation is required. While it prevents deletion and ensures content integrity, its core function does not include defining a lifecycle that automatically deletes content after a time-based rule. It focuses on permanent preservation rather than scheduled disposition.
- ✗
Data Loss Prevention
Why it's wrong here
Data Loss Prevention (DLP) policies are designed to identify, monitor, and protect sensitive information from being inappropriately shared, transferred, or exfiltrated outside the organization. DLP focuses on preventing data breaches and unauthorized disclosure by blocking or auditing specific actions, such as sharing HR documents with external parties. It does not provide functionality for retaining documents for a specified period or managing their lifecycle through automatic deletion.
- ✗
Audit
Why it's wrong here
Microsoft Purview Audit logs user and administrator activities across various services, providing a comprehensive forensic record for security investigations, compliance, and troubleshooting. While auditing tracks who accessed, modified, or deleted a document, it is fundamentally a monitoring and logging mechanism. It does not enforce any policies regarding the retention period of documents or their automatic deletion; it merely records events for review.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.