SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A financial services organization must comply with a regulation that requires all communications related to trades (including emails and Teams messages) to be retained for a period of 7 years. During retention, no user may edit or delete these records. After the 7 years, the records must be disposed of with an irreversible deletion that is verified by a compliance officer. Which Microsoft Purview solution should the organization use to enforce both retention and regulatory disposition?
⚠ Common exam trap
Test-takers frequently confuse 'standard retention labels' (which allow edits and deletions by authorized users) with 'regulatory retention labels' (which enforce immutable retention and require disposition review), leading them to select Data Lifecycle Management instead of Records Management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Records Management (regulatory retention label)
Microsoft Purview Records Management with a regulatory retention label is the correct solution because it enforces immutable retention (no user edits or deletions) and mandates a disposition review by a compliance officer before irreversible deletion. Regulatory labels lock the retention policy at the highest level, preventing any user or administrator from shortening the retention period or bypassing the disposition workflow, which aligns with the 7-year retention and verified disposal requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Records Management (regulatory retention label)
Why this is correct
Records Management with a retention label marked as a regulatory record permanently locks the content, preventing any modification or deletion during the retention period. It also supports disposition workflows to require approval before permanent deletion.
- ✗
Microsoft Purview Data Lifecycle Management (standard retention label)
Why it's wrong here
A standard retention label within Data Lifecycle Management primarily prevents the deletion of content for a specified period, ensuring data availability. However, it does not prevent modification of the content by users or administrators during the retention period. For financial services and other highly regulated industries, regulations often mandate that records be unalterable and immutable (WORM), a requirement that standard retention labels cannot fulfill, making them insufficient for strict regulatory compliance.
When this WOULD be correct
An organization needs to retain emails for 3 years for general business purposes, after which users can delete them manually. Data Lifecycle Management with standard retention labels would be correct because no regulatory compliance or disposition verification is required.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Designed as a supervision solution, Communication Compliance monitors internal and external communications across various platforms (e.g., Microsoft Teams, Exchange) for policy violations like harassment, insider trading, or regulatory misconduct. It facilitates investigation and remediation of policy breaches but does not enforce data retention, ensure content immutability, or manage the lifecycle of records. It's a monitoring and review tool, not a system for establishing and maintaining regulatory records.
When this WOULD be correct
An organization needs to monitor employee communications for potential regulatory violations (e.g., insider trading) and escalate them for legal review. The question would specify that the goal is to detect and investigate policy breaches in communications, not to retain or dispose of records.
- ✗
Microsoft Purview Insider Risk Management
Why it's wrong here
This solution is engineered to detect and mitigate internal threats, such as data exfiltration, intellectual property theft, or confidentiality breaches, by analyzing user activities and behaviors. While crucial for security, it lacks the core functionalities for regulatory record keeping, including the ability to apply immutable retention labels, manage formal disposition workflows, or provide proof of record authenticity over time. Its focus is on risk detection and response, not data lifecycle governance for compliance.
When this WOULD be correct
An organization needs to detect and investigate potential data theft by employees who exfiltrate sensitive trade communications before the retention period ends. Insider Risk Management would be correct to identify and alert on such risky behavior.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Purview Records Management (regulatory retention label)Correct answer▾
Why this is correct
Records Management with a retention label marked as a regulatory record permanently locks the content, preventing any modification or deletion during the retention period. It also supports disposition workflows to require approval before permanent deletion.
✗Microsoft Purview Data Lifecycle Management (standard retention label)Wrong answer — click to see why▾
Why this is wrong here
Standard retention labels in Data Lifecycle Management do not support regulatory disposition with irreversible deletion verified by a compliance officer; they lack the 'regulatory' record type and disposition verification workflow required by the regulation.
★ When this WOULD be the correct answer
An organization needs to retain emails for 3 years for general business purposes, after which users can delete them manually. Data Lifecycle Management with standard retention labels would be correct because no regulatory compliance or disposition verification is required.
Why candidates choose this
Candidates confuse 'retention' with 'regulatory retention', assuming any retention label meets compliance needs, and overlook the specific requirements for irreversible deletion and disposition verification unique to Records Management.
✗Microsoft Purview Communication ComplianceWrong answer — click to see why▾
Why this is wrong here
Communication Compliance is designed to detect and review communications that violate organizational policies (e.g., insider trading, harassment), not to enforce immutable retention or regulatory disposition. It does not provide the required 7-year retention with irreversible deletion and compliance officer verification.
★ When this WOULD be the correct answer
An organization needs to monitor employee communications for potential regulatory violations (e.g., insider trading) and escalate them for legal review. The question would specify that the goal is to detect and investigate policy breaches in communications, not to retain or dispose of records.
Why candidates choose this
Candidates may confuse the regulatory compliance aspect of Communication Compliance with the retention and disposition requirements, assuming that a solution named 'Communication Compliance' would handle all compliance needs for communications.
✗Microsoft Purview Insider Risk ManagementWrong answer — click to see why▾
Why this is wrong here
Insider Risk Management is designed to detect, investigate, and act on risky user activities (e.g., data leaks, policy violations), not to enforce retention or regulatory disposition of records. It lacks the ability to apply retention labels or trigger irreversible deletion after a fixed period.
★ When this WOULD be the correct answer
An organization needs to detect and investigate potential data theft by employees who exfiltrate sensitive trade communications before the retention period ends. Insider Risk Management would be correct to identify and alert on such risky behavior.
Why candidates choose this
Candidates may confuse the 'compliance officer verification' requirement with insider risk workflows, mistakenly thinking that monitoring user actions for disposition verification is part of Insider Risk Management.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Records Management
Records management is the systematic control of an organization's records, from creation or receipt through processing, distribution, maintenance, storage, retrieval, and disposal, ensuring integrity, compliance, and availability.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.