SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company uses Microsoft Purview to manage data compliance. They need to meet regulatory requirements that mandate retention of financial records for 7 years and deletion of personal data after 3 years. Which THREE capabilities should they configure?
⚠ Common exam trap
Many candidates confuse Communication Compliance or eDiscovery with retention management, but neither provides the automated retention and deletion scheduling required for regulatory compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Information Protection
Microsoft Purview Information Protection (A) is correct because it enables classification and labeling of sensitive data, such as financial records and personal data, with retention and deletion policies. This ensures that data is retained for the required 7 years and deleted after 3 years, meeting regulatory mandates. It works by applying sensitivity labels that trigger retention or deletion actions based on the label's configured settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Information Protection
Why this is correct
Microsoft Purview Information Protection enables organizations to classify and label sensitive data using sensitivity labels, whether manually or automatically. These labels are crucial as they can be configured to automatically apply specific retention and deletion policies, ensuring data is retained for the required period or disposed of appropriately based on its content and classification. This capability is fundamental for enforcing data compliance requirements by governing data based on its sensitivity.
- ✓
Microsoft Purview Records Management
Why this is correct
Microsoft Purview Records Management specifically addresses the lifecycle of high-value, business-critical items that must be retained for legal, business, or regulatory reasons. It enables organizations to declare content as a record, which prevents its modification or premature deletion, and ensures it is retained for a specific, mandated period. This specialized function is crucial for maintaining immutable records and demonstrating compliance with stringent regulatory obligations.
- ✓
Microsoft Purview Data Lifecycle Management
Why this is correct
Data Lifecycle Management (DLM) provides comprehensive capabilities to manage data from its creation to its eventual disposition across various data sources. It allows organizations to define and apply broad retention and deletion policies, ensuring that data is kept for the necessary duration and then permanently deleted when no longer required. This service directly supports compliance obligations by automating the entire data lifecycle based on organizational and regulatory requirements.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Microsoft Purview Communication Compliance is designed to help organizations detect, investigate, and remediate policy violations within internal and external communications, such as harassment, inappropriate content, or insider trading. While it contributes to overall compliance by fostering a safe and compliant workplace, its primary function is monitoring and auditing communication content. It does not directly manage the retention or deletion lifecycle of data.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery tools are primarily utilized for identifying, preserving, collecting, processing, reviewing, and analyzing electronic data in response to specific legal cases, regulatory investigations, or internal inquiries. Its purpose is to facilitate the discovery process for particular events by providing tools to manage data relevant to a case. This service is a reactive tool for investigations, rather than a proactive service for establishing automated, ongoing data retention and deletion policies for general data lifecycle management.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Information protection
Information protection refers to the policies, procedures, and technologies used to safeguard data from unauthorized access, disclosure, alteration, or destruction.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.