SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A compliance officer needs to automatically detect documents containing passport numbers in SharePoint Online and apply a retention label that retains the documents for 10 years before deleting them. They also want to prevent users from permanently deleting these documents before the retention period ends. Which Microsoft Purview solution should they use to achieve this?
⚠ Common exam trap
Candidates often confuse Data Lifecycle Management with Data Loss Prevention, assuming DLP handles retention, when in fact DLP only prevents data exfiltration and does not manage retention periods or deletion prevention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Lifecycle Management
Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it enables organizations to automatically apply retention labels to sensitive content—such as documents containing passport numbers—based on sensitive information types. It also enforces a retention period (10 years) and prevents users from permanently deleting documents before that period ends, meeting both the detection and preservation requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection (MPIP) is designed to classify, label, and protect sensitive data across its lifecycle, primarily through sensitivity labels, encryption, and visual markings. While it identifies sensitive content, its core function is to enforce access controls and prevent unauthorized access or use, not to define or automatically manage retention periods or deletion schedules for documents. Therefore, it does not fulfill the requirement of automatically detecting documents for lifecycle management.
- ✓
Microsoft Purview Data Lifecycle Management
Why this is correct
Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for automatically detecting documents and managing their retention and deletion. DLM utilizes retention labels and policies that can be automatically applied to content based on specific conditions, such as sensitive information types or keywords. These policies ensure that documents are retained for required periods and then disposed of according to compliance regulations, including managing holds for legal discovery and disposition reviews.
- ✗
Microsoft Purview Data Loss Prevention (DLP)
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) policies are primarily focused on identifying, monitoring, and protecting sensitive information from unauthorized sharing or transfer outside the organization. DLP detects sensitive data in transit or at rest and can block, warn, or audit actions that violate policy. However, DLP's purpose is not to manage the long-term retention or eventual deletion of documents within the organization's repositories, making it unsuitable for this compliance requirement.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit provides a comprehensive logging solution that records user and administrator activities across various Microsoft 365 services. It enables organizations to investigate security incidents, comply with regulatory obligations by providing an audit trail, and monitor user actions. While crucial for accountability, Audit does not possess the capability to automatically detect documents, apply retention labels, or enforce lifecycle management policies for content itself.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Labels
Labels are descriptive text or tags attached to IT resources to organize, identify, and manage them based on attributes like purpose, environment, or owner.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.