SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company uses Microsoft 365 and must comply with a regulation that requires all business records, including emails and documents, to be retained for exactly 5 years. They need to automatically apply a retention label to any item that contains the keyword 'Contract' when the item is created or modified. Which Microsoft Purview solution should they use to configure this automatic labeling?
⚠ Common exam trap
A common mix-up: candidates confuse Data Lifecycle Management with Data Loss Prevention (DLP), assuming DLP can apply retention labels, but DLP only enforces actions like blocking or warning, not retention labeling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Lifecycle Management
Data Lifecycle Management (DLM) in Microsoft Purview enables automatic retention labeling based on sensitive content, such as keywords like 'Contract'. It uses auto-labeling policies to apply retention labels at the time of creation or modification, ensuring compliance with the 5-year retention requirement without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Lifecycle Management
Why this is correct
Microsoft Purview Data Lifecycle Management (formerly Information Governance) enables organizations to manage content throughout its lifecycle. It allows the creation of retention labels that can be automatically applied to content in Microsoft 365 locations like Exchange, SharePoint, and OneDrive based on specific conditions, such as keywords, sensitive information types, or trainable classifiers. This capability directly supports compliance regulations by ensuring data is retained or deleted according to policy, without manual intervention, thus meeting the requirement for automatic labeling based on content.
- ✗
Data Loss Prevention (DLP)
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) policies are designed to identify, monitor, and protect sensitive information across Microsoft 365 services and endpoints. DLP prevents the inappropriate sharing, transfer, or use of sensitive data by detecting specific content (e.g., credit card numbers) and enforcing actions like blocking, auditing, or notifying users. While crucial for data protection, DLP's primary function is not to apply retention labels for data lifecycle management, but rather to prevent data exfiltration or misuse.
- ✗
Audit
Why it's wrong here
Microsoft Purview Audit logs record user and administrator activities across various Microsoft 365 services, providing a comprehensive trail of actions performed within the environment. These logs are essential for forensic investigations, security monitoring, and demonstrating compliance by proving who did what, when, and where. However, the auditing capability is purely for recording and reporting activities; it does not have any functionality to automatically apply retention labels to content based on its characteristics or lifecycle stage.
- ✗
Compliance Manager
Why it's wrong here
Microsoft Purview Compliance Manager is a workflow-based solution that helps organizations manage their compliance posture against various regulations and industry standards. It provides pre-built templates for common regulations, allows users to track progress on improvement actions, and calculates a compliance score. While invaluable for assessing and improving overall compliance, Compliance Manager is an assessment and management tool; it does not directly implement or enforce data governance policies like automatically applying retention labels to content.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Labels
Labels are descriptive text or tags attached to IT resources to organize, identify, and manage them based on attributes like purpose, environment, or owner.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.