SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company uses Microsoft 365 and needs to automatically apply a retention label to documents that contain personally identifiable information (PII) in SharePoint Online. The label should retain the documents for 5 years and then delete them. Which Microsoft Purview solution should they use?
⚠ Common exam trap
Candidates often confuse the purpose of Data Lifecycle Management (retention and deletion) with Information Protection (sensitivity labels and encryption), especially since both use labels and can be auto-applied based on sensitive content.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Lifecycle Management
Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Records Management) is the solution specifically designed to apply retention labels and policies that automatically retain content for a specified period and then delete it. In this scenario, the requirement to automatically apply a retention label to documents containing PII in SharePoint Online and then retain them for 5 years before deletion is a core capability of Data Lifecycle Management, which uses auto-labeling policies based on sensitive information types.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection focuses on classifying data based on its sensitivity and applying protective measures. This includes encryption, visual markings like headers/footers, and restricting access permissions to prevent unauthorized access. While crucial for data security and compliance, it does not provide mechanisms for automatically applying retention periods or managing the eventual deletion of content based on lifecycle rules.
- ✗
Microsoft Purview Data Loss Prevention (DLP)
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) policies are designed to identify, monitor, and protect sensitive information from being inappropriately shared, either accidentally or maliciously, within or outside the organization. DLP policies enforce rules to prevent data exfiltration by blocking, warning, or auditing actions involving sensitive data. However, DLP's primary function is preventing data loss, not managing the long-term retention or automated deletion of content according to a defined lifecycle.
- ✓
Microsoft Purview Data Lifecycle Management
Why this is correct
Microsoft Purview Data Lifecycle Management (DLM) is specifically engineered to manage the lifecycle of information, including its retention and eventual disposition. DLM utilizes retention labels that can be manually applied or automatically assigned to content based on specific conditions, such as sensitive information types, keywords, or content properties. These labels then enforce retention periods, ensuring data is kept for the required duration and automatically deleted when no longer needed, directly addressing the need for automated retention and deletion policies.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery provides tools for identifying, preserving, collecting, processing, reviewing, and analyzing electronically stored information (ESI) for legal or regulatory investigations. Its core function involves placing content on legal hold to prevent its alteration or deletion, ensuring data integrity for litigation or audits. eDiscovery does not, however, offer capabilities for automatically applying routine retention schedules or managing the automated deletion of content as part of a standard information lifecycle.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Personally identifiable information
Personally identifiable information (PII) is any data that can be used to identify, contact, or locate a specific individual, either alone or when combined with other information.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.