SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A financial services company needs to comply with GDPR and requires that personal data be automatically classified and protected when stored in Microsoft SharePoint and OneDrive. They also need to retain certain records for a minimum of 7 years. Which combination of Microsoft Purview capabilities should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity labels and retention labels
Sensitivity labels classify and protect personal data (e.g., encrypt, apply markings), while retention labels enforce the required 7-year retention period. Option A is incorrect because DLP policies detect and prevent data loss but do not enforce retention. Option C is incorrect because DLP policies do not classify data. Option D is incorrect because eDiscovery is for searching and exporting data, not for classification or retention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sensitivity labels and data loss prevention (DLP) policies
Why it's wrong here
Sensitivity labels classify and protect content, and DLP prevents sharing, but neither applies retention periods, so the seven-year requirement is unmet. This pairing is tempting because labels plus DLP is the standard answer for classification and protection scenarios; it would be correct if retention were not required.
- ✓
Sensitivity labels and retention labels
Why this is correct
Sensitivity labels auto-classify and protect personal data across SharePoint and OneDrive, while retention labels keep specified records for the mandated seven years. Together they satisfy both the GDPR protection requirement and the minimum retention period within Microsoft Purview.
- ✗
Data loss prevention (DLP) policies and retention labels
Why it's wrong here
DLP enforces sharing rules but does not automatically classify stored personal data, and retention labels alone do not protect content, so automatic classification fails. This combination is tempting because retention labels satisfy the seven-year requirement; it would be correct if the stem asked only for retention plus leak prevention.
- ✗
eDiscovery and sensitivity labels
Why it's wrong here
eDiscovery handles legal hold and case review, not automatic classification or protection of data at rest, and it does not enforce retention. Sensitivity labels alone classify and protect but do not retain records. The stem requires auto-labelling plus retention, which eDiscovery cannot deliver.
Go deeper
Related to this question
Learn chapter
GDPR, HIPAA, and Global Privacy Laws
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
GDPR
The General Data Protection Regulation (GDPR) is a European Union law that sets strict rules for how organizations collect, store, process, and protect the personal data of individuals within the EU.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.