SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A healthcare organization stores patient records in SharePoint Online. The compliance officer needs to ensure that records containing Protected Health Information (PHI) are retained for 7 years per regulatory requirements. Which Microsoft Purview solution should they implement?
⚠ Common exam trap
Many exam-takers confuse Data Lifecycle Management (which handles non-record content like temporary files) with Records Management (which handles declarative records with immutable retention), leading them to choose D instead of C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Records Management
Microsoft Purview Records Management is the correct solution because it enables organizations to apply retention labels and policies that enforce mandatory retention periods for regulatory compliance. For patient records containing PHI, a retention label can be configured to retain the data for exactly 7 years and then trigger a disposition review or automatic deletion, ensuring the organization meets healthcare regulatory requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit provides a comprehensive logging service that tracks user and administrator activities across various Microsoft 365 services, including SharePoint. While crucial for forensic investigations, security monitoring, and demonstrating accountability, its primary function is to record events and provide an immutable audit trail. Audit capabilities do not extend to proactively applying or enforcing retention labels on content, declaring items as records, or preventing content modification or deletion based on a defined retention schedule, making it unsuitable for direct records retention enforcement.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery is a specialized set of tools designed to identify, preserve, collect, process, review, and export electronically stored information (ESI) for legal or investigative purposes, such as litigation or internal inquiries. Although eDiscovery can place content on legal hold to prevent its deletion or modification for the duration of a case, this is a reactive, case-specific preservation mechanism. It is not an organization-wide, proactive system for managing long-term regulatory retention schedules or formally declaring content as immutable records with defined disposition processes.
- ✓
Microsoft Purview Records Management
Why this is correct
Microsoft Purview Records Management is precisely engineered to help organizations meet their legal, business, and regulatory obligations for records retention and disposition, particularly for highly sensitive data like patient records. This solution enables the classification of content as a formal record, applying immutable retention labels that prevent modification or deletion, even by administrators, and managing the entire lifecycle from creation to final disposition. It ensures that critical information is preserved according to specific healthcare regulations, providing the necessary legal defensibility and compliance.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management (DLM) focuses on managing the lifecycle of all data, including non-record content, by applying retention and deletion policies for operational efficiency, compliance with privacy regulations like GDPR, or general data hygiene. While DLM can apply retention labels, it lacks the specific functionality to formally declare content as an immutable 'record' with the stringent regulatory implications and legal defensibility required for patient records. DLM primarily manages the general data lifecycle, whereas Records Management specifically addresses the unique requirements of regulatory records.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.