SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A healthcare organization is implementing Microsoft Purview Data Lifecycle Management to retain medical records for 7 years. Which THREE components must be configured to achieve this retention requirement?
⚠ Common exam trap
Test-takers frequently confuse sensitivity labels (classification/protection) with retention labels (lifecycle management), leading them to select Option C, or they mistakenly think DLP policies are required for retention, when in fact DLP is a separate security control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a retention label policy to publish the label.
A retention label policy is required to publish the retention label so that it can be automatically or manually applied to the medical records. Without publishing the label via a policy, the label itself cannot be assigned to content, and the retention period will not take effect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a retention label policy to publish the label.
Why this is correct
After a retention label is defined, it must be published via a retention label policy to make it available for users or auto-application within Microsoft 365 services like SharePoint, OneDrive, and Exchange. This policy specifies which locations the label will be published to, ensuring the label appears as an option for manual application or is used by auto-apply policies. Without publishing through a policy, the label remains an administrative definition and cannot be actively used to manage content lifecycle.
- ✓
Create a retention label with a retention period of 7 years.
Why this is correct
A retention label is a core component in Microsoft Purview that defines the specific retention actions and periods for content, such as retaining items for 7 years, deleting them after a certain period, or both. This label encapsulates the rules for how long an item should be kept and what happens to it afterward, aligning with regulatory or organizational requirements. It serves as the granular instruction set that will be applied to individual items or groups of items.
- ✗
Apply a sensitivity label to classify the records.
Why it's wrong here
Sensitivity labels in Microsoft Purview are primarily designed for classifying data based on its confidentiality and impact, such as "Confidential" or "Highly Confidential," and applying protection actions like encryption or visual markings. While they help identify sensitive information, they do not inherently define retention periods or actions for content lifecycle management. Their purpose is data protection and access control, not the governance of how long data is kept.
- ✓
Configure adaptive scopes to target the relevant users or sites.
Why this is correct
Adaptive scopes provide a dynamic and flexible way to define the specific locations (users, groups, or sites) where a retention policy or label policy will apply, based on attributes like department, country, or project. Instead of static inclusions, adaptive scopes use KQL queries to automatically include or exclude locations as their attributes change, ensuring policies are always applied to the correct and relevant data sets without manual updates. This precision is crucial for large, dynamic organizations.
- ✗
Implement Data Loss Prevention (DLP) policies to prevent data exfiltration.
Why it's wrong here
Data Loss Prevention (DLP) policies in Microsoft Purview are designed to identify, monitor, and protect sensitive information from being inappropriately shared, transferred, or exfiltrated outside the organization. DLP focuses on preventing data breaches and ensuring compliance with data handling regulations by blocking or auditing specific actions. While critical for security, DLP policies do not define or manage the retention periods or lifecycle of data within the organization; their scope is data egress and misuse, not long-term data governance.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Retention label
A retention label is a tag applied to emails, documents, or files in Microsoft 365 that tells the system how long to keep the item and what to do with it when the time is up.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.