SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft Purview Data Lifecycle Management. To comply with regulatory requirements, the company must retain financial records for 7 years and then delete them. Which THREE actions should the company configure? (Select THREE.)
⚠ Common exam trap
It's easy for candidates to confuse retention policies (which apply to all content in a location) with retention labels (which can be scoped to specific content), and they forget that a disposition review is a separate configuration needed to confirm deletion rather than assuming automatic deletion occurs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a retention label with a retention period of 7 years
A retention label with a 7-year retention period allows you to apply specific retention and deletion rules to individual documents, such as financial records, rather than to an entire site. This granularity is necessary when only a subset of content within a SharePoint site must be retained for compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a data loss prevention policy
Why it's wrong here
DLP policies are designed to identify, monitor, and protect sensitive information from being shared inappropriately or leaving the organization's control boundaries. Their primary function is to prevent data exfiltration or misuse, not to define how long data should be retained or when it should be deleted as part of a data lifecycle management strategy. Therefore, a DLP policy would not address the requirement for a 7-year retention period.
- ✗
Create a retention policy for the entire SharePoint site
Why it's wrong here
While retention policies can apply to locations like SharePoint sites, applying one to the entire site would enforce the specified retention period on all content within that site, regardless of its specific nature. This approach lacks the granularity needed if only specific types of content, such as financial records, require a particular 7-year retention period, potentially over-retaining or under-retaining other content. Retention labels offer more precise control for specific record types.
- ✓
Create a retention label with a retention period of 7 years
Why this is correct
Retention labels in Microsoft Purview Data Lifecycle Management are specifically designed to apply precise retention settings, such as a 7-year retention period, to individual items like documents or emails. This allows for granular control over the lifecycle of specific content types, ensuring that financial records, for instance, are retained for the exact required duration based on regulatory or business needs. Labels can also trigger actions like disposition reviews at the end of the retention period.
- ✓
Configure a disposition review to confirm deletion
Why this is correct
A disposition review is a critical component of compliant data lifecycle management, especially for records that require formal disposal. By configuring a disposition review, designated reviewers can examine content at the end of its 7-year retention period before it is permanently deleted. This human oversight ensures that no vital information is inadvertently removed and provides an auditable process for the defensible destruction of records.
- ✓
Create an auto-labeling policy to apply the retention label to financial records
Why this is correct
An auto-labeling policy automates the application of retention labels to content based on specific conditions, such as the presence of sensitive information types, keywords, or trainable classifiers. For financial records, this policy would automatically identify and apply the "7-year retention" label, ensuring consistent and efficient classification across the organization without requiring manual user intervention. This significantly streamlines compliance efforts for large volumes of data.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Retention label
A retention label is a tag applied to emails, documents, or files in Microsoft 365 that tells the system how long to keep the item and what to do with it when the time is up.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.