SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A financial organization is required by regulation to keep all customer transaction records for 10 years. After 10 years, the records must be permanently deleted. In addition, during the retention period, records must not be modifiable or deletable by any user, including administrators. Which Microsoft Purview solution should they use to meet these requirements?
⚠ Common exam trap
Many candidates confuse Data Lifecycle Management with Records Management, not realizing that only Records Management provides the immutability lock required to prevent modification or deletion by administrators during the retention period.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Records Management
Records Management in Microsoft Purview is designed to meet regulatory requirements by allowing organizations to declare records or regulatory records. When a record is declared, it becomes immutable—no user, including administrators, can modify or delete it during the retention period. The 10-year retention and mandatory deletion after that period are enforced through a retention label configured as a record, which locks the item and triggers permanent deletion upon expiration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Retention labels (unlocked)
Why it's wrong here
Unlocked retention labels apply specific retention settings to content, preventing its permanent deletion for a defined period. However, crucially, they still permit users with appropriate permissions to modify or even delete the content *before* the retention period expires. This flexibility directly contradicts the regulatory requirement for immutability, which demands that declared records remain unaltered and undeletable once created.
- ✓
Records Management
Why this is correct
Records Management uses retention labels with a disposition review, and when a label is marked as a record, content cannot be modified or deleted. After the retention period, a disposition review can trigger permanent deletion.
- ✗
Information Protection with sensitivity labels
Why it's wrong here
Sensitivity labels are designed primarily for data classification, encryption, and access control, ensuring that sensitive information is protected from unauthorized disclosure. While they can restrict who can access or modify content, they do not inherently enforce immutability or manage the content's lifecycle for regulatory retention and disposition. They focus on data security and privacy, not the unalterable preservation of records over time.
- ✗
Data Lifecycle Management
Why it's wrong here
Data Lifecycle Management (DLM) encompasses broad retention policies applied to entire locations, such as SharePoint sites or Exchange mailboxes, to manage data at scale. While DLM can prevent deletion and enforce retention periods, it typically lacks the granular "record declaration" feature for individual items and the robust, auditable disposition review workflow essential for transactional records under strict regulatory compliance. It manages data broadly rather than individual, immutable records.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Records Management
Records management is the systematic control of an organization's records, from creation or receipt through processing, distribution, maintenance, storage, retrieval, and disposal, ensuring integrity, compliance, and availability.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.