SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A healthcare organization must automatically detect documents containing patient health information (PHI) in SharePoint Online and apply a retention label that retains the documents for 10 years. Additionally, they want to prevent users from permanently deleting these documents during the retention period. Which Microsoft Purview solution should they use to achieve this?
⚠ Common exam trap
Many candidates confuse Data Lifecycle Management (which handles retention and deletion but not immutability) with Records Management (which adds the critical 'lock as a record' capability to prevent deletion), leading them to incorrectly select option A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Records Management
Records Management (option B) is correct because it enables organizations to declare documents as records, which locks them against deletion or modification for a specified retention period. In this scenario, automatically detecting PHI in SharePoint Online and applying a retention label that both retains documents for 10 years and prevents permanent deletion is a core Records Management capability, as it uses retention labels configured to mark items as records (or regulatory records) to enforce immutability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Lifecycle Management
Why it's wrong here
Incorrect. Data Lifecycle Management (previously called Microsoft 365 retention) can apply retention labels and retain content for a specified period, but it does not by itself prevent users from permanently deleting the content. Only Records Management (by marking items as records) provides that deletion protection.
- ✓
Records Management
Why this is correct
Correct. Records Management uses retention labels that can be configured to mark items as records. When an item is a record, it cannot be deleted, edited, or modified by users during the retention period. This satisfies the requirement to prevent permanent deletion.
- ✗
Data Loss Prevention (DLP)
Why it's wrong here
Incorrect. DLP policies can detect PHI and automatically apply actions like blocking or warning users, but DLP does not apply retention labels. DLP and Records Management are separate solutions that can be used together, but DLP alone cannot apply retention labels.
- ✗
Communication Compliance
Why it's wrong here
Communication Compliance is a solution focused on detecting and acting on policy violations within an organization's communications, such as inappropriate language, harassment, or insider trading. It analyzes content across Microsoft 365 services like Exchange, Teams, and Yammer. While it can identify sensitive information in messages, its purpose is not to apply retention labels, manage document lifecycles, or prevent the permanent deletion of documents, which is the specific requirement of the question.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.