SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A compliance officer at Contoso needs to ensure that all email messages containing the phrase 'Project Falcon' are retained for seven years and then permanently deleted, without relying on end users to apply labels. The organization uses Microsoft 365 E5 and Exchange Online. Which Microsoft Purview feature should the officer configure?
⚠ Common exam trap
The trap here is assuming that a sensitivity label is required to retain content, when a retention policy with a keyword query can handle automatic retention and deletion without any labeling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A retention policy with a keyword query condition
A retention policy in Microsoft Purview can be scoped to Exchange Online and use a keyword query condition to find messages containing 'Project Falcon'. It then retains those items for the specified duration and deletes them afterward. This meets the need for automatic, service-level retention and deletion without user-applied labels or manual holds.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A data loss prevention (DLP) policy for Exchange Online
Why it's wrong here
DLP policies detect and block or warn about sensitive information being shared, but they do not retain or delete items after a set period. DLP could identify 'Project Falcon' content, yet it cannot enforce a seven-year retention then deletion lifecycle. The requirement is retention, not prevention of sharing.
- ✗
A sensitivity label with encryption settings
Why it's wrong here
Sensitivity labels are designed for classification and protection such as encryption or content marking, not for enforcing retention or deletion periods. Although a label can have a retention setting via label policies, it still requires user or auto-labeling to apply, and the scenario demands no user interaction. Encryption does not address retention duration or deletion.
- ✓
A retention policy with a keyword query condition
Why this is correct
A retention policy can target Exchange Online and include a keyword query condition to match messages containing 'Project Falcon'. It applies automatically at the service level, retains matching items for seven years, and then deletes them, without requiring user-applied labels. This directly satisfies the requirement for automatic, centralized retention.
- ✗
An eDiscovery hold on all Exchange Online mailboxes
Why it's wrong here
An eDiscovery hold preserves content for legal or investigative purposes, but it does not automatically delete items after seven years. Holds are typically indefinite or case-driven and are managed by eDiscovery managers. They also do not provide a simple keyword-based retention rule for everyday compliance retention.
Go deeper
Related to this question
Learn chapter
Microsoft Purview Compliance Portal
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.