SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company must retain all vendor contracts for 10 years to meet regulatory requirements. After 10 years, the contracts must be permanently destroyed with no possibility of recovery. The compliance team wants to automate this lifecycle and ensure that during the retention period, the contracts cannot be edited or deleted by users. Which Microsoft Purview solution should they use?
⚠ Common exam trap
Microsoft often tests the distinction between Data Lifecycle Management (which manages non-record content) and Records Management (which enforces immutability and disposition for regulatory records), so the trap here is assuming DLM can provide the required edit/delete prevention and automatic destruction, when only Records Management offers those capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Records Management
Records Management in Microsoft Purview is designed to declare records (regulatory or legal) that must be retained for a specific period and then disposed of in a compliant manner. It enforces immutability during the retention period—users cannot edit or delete records—and supports a disposition review or automatic permanent deletion after the retention period ends, exactly matching the requirement for 10-year retention followed by destruction with no recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Lifecycle Management (DLM)
Why it's wrong here
Data Lifecycle Management (via retention policies and labels) can manage retention and deletion, but it does not provide the 'record' status that locks a document to prevent editing. DLM is for general content lifecycle, not regulatory records.
When this WOULD be correct
A company needs to automatically delete old customer data after 5 years to comply with a data privacy law, but users can edit the data during the retention period. DLM would be the correct solution to set retention and deletion policies without requiring record-level restrictions.
- ✓
Records Management
Why this is correct
Microsoft Purview Records Management is specifically designed for regulatory, legal, and business-critical recordkeeping, ensuring content immutability. It utilizes retention labels to classify items as records, which prevents their modification or deletion for a specified period, such as 10 years for vendor contracts. This capability is crucial for meeting strict retention requirements and supporting automated disposition reviews, ensuring compliance with organizational and legal obligations.
- ✗
eDiscovery (Premium)
Why it's wrong here
eDiscovery (Premium) in Microsoft Purview is primarily used for identifying, preserving, collecting, processing, and reviewing electronically stored information (ESI) for legal or internal investigations. While it can place content on legal hold to prevent deletion, it does not automate the scheduled retention and disposition of records based on a fixed, pre-defined period like 10 years. Its purpose is reactive preservation for specific cases, not proactive, long-term records management.
- ✗
Sensitivity Labels
Why it's wrong here
Sensitivity labels are used to classify and protect sensitive data by applying encryption, visual markings, and access restrictions to content. While they help prevent unauthorized access or sharing, they do not enforce immutable retention policies that prevent modification or deletion of documents for a specified duration, such as 10 years. Their primary function is data protection and governance based on sensitivity, not long-term record immutability or scheduled disposition.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Records ManagementCorrect answer▾
Why this is correct
Microsoft Purview Records Management is specifically designed for regulatory, legal, and business-critical recordkeeping, ensuring content immutability. It utilizes retention labels to classify items as records, which prevents their modification or deletion for a specified period, such as 10 years for vendor contracts. This capability is crucial for meeting strict retention requirements and supporting automated disposition reviews, ensuring compliance with organizational and legal obligations.
✗Data Lifecycle Management (DLM)Wrong answer — click to see why▾
Why this is wrong here
Data Lifecycle Management (DLM) manages retention and deletion of data but does not enforce immutability or prevent users from editing/deleting records during the retention period. The question requires that contracts cannot be edited or deleted, which is a records management feature.
★ When this WOULD be the correct answer
A company needs to automatically delete old customer data after 5 years to comply with a data privacy law, but users can edit the data during the retention period. DLM would be the correct solution to set retention and deletion policies without requiring record-level restrictions.
Why candidates choose this
Candidates may confuse DLM with Records Management because both handle retention and deletion, but DLM lacks the immutability and legal hold capabilities required for records that must be preserved unaltered.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Recovery
Recovery is the process of restoring systems, data, and operations after a security incident, failure, or disaster to return to normal functioning.
Key term
Records Management
Records management is the systematic control of an organization's records, from creation or receipt through processing, distribution, maintenance, storage, retrieval, and disposal, ensuring integrity, compliance, and availability.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.