SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A legal team is involved in a lawsuit and needs to ensure that all emails and documents related to the case are preserved in their original state, even if users edit or delete them. They also need the ability to search for these items and export them for legal review. Which Microsoft Purview solution should the compliance team configure to meet these requirements?
⚠ Common exam trap
It's easy for candidates to confuse Data Lifecycle Management (retention/deletion) with eDiscovery (preservation/search/export), or mistakenly think Audit (Standard) can preserve and export content when it only records metadata about activities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview eDiscovery (Standard)
Microsoft Purview eDiscovery (Standard) is the correct solution because it provides the ability to place a legal hold on content (preserving emails and documents in their original state even if users edit or delete them), perform searches across Exchange Online, SharePoint Online, OneDrive for Business, and Teams, and export the results for legal review. This directly meets the requirements of preservation, search, and export for litigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Compliance Manager
Why it's wrong here
Microsoft Purview Compliance Manager provides a centralized dashboard to assess and improve an organization's compliance posture against various regulatory standards and internal policies. While it offers actionable recommendations and tracks progress on compliance activities, its primary function is assessment and reporting. It lacks the operational capabilities to place legal holds on specific content, conduct targeted searches for electronically stored information (ESI) across user data, or export those items for legal review, which are essential for litigation.
When this WOULD be correct
A compliance officer needs to assess the organization's compliance against regulatory standards (e.g., GDPR, ISO 27001) and track improvement actions. Compliance Manager would be the correct solution.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Data Lifecycle Management (retention labels and policies) can enforce retention and deletion rules, but it cannot place a legal hold that preserves content against modification or deletion, nor does it provide the search and export features needed for litigation.
When this WOULD be correct
A question asking for a solution to automatically retain emails for a specific period (e.g., 7 years) and then delete them, without needing legal hold or search/export capabilities, would make Data Lifecycle Management correct.
- ✓
Microsoft Purview eDiscovery (Standard)
Why this is correct
Microsoft Purview eDiscovery (Standard) is specifically designed to address legal and investigative requirements by enabling organizations to identify, preserve, collect, and export electronically stored information (ESI). It allows legal teams to place immutable legal holds on content across Microsoft 365 services like Exchange, SharePoint, OneDrive, and Teams, preventing modification or deletion. Furthermore, it provides robust content search capabilities and the ability to export collected items in a defensible manner for external review, directly supporting the needs of a lawsuit.
- ✗
Microsoft Purview Audit (Standard)
Why it's wrong here
Microsoft Purview Audit (Standard) is primarily focused on recording user and administrator activities within Microsoft 365 services, generating an audit trail for security investigations, forensic analysis, and compliance monitoring. It logs *who* performed *what* action and *when*, but it does not preserve the actual content of documents, emails, or messages. Its functionality is limited to searching these activity logs, not placing legal holds on content or exporting the original items themselves for legal discovery and review.
When this WOULD be correct
A compliance team needs to investigate a security incident by reviewing user activity logs (e.g., who accessed a file, when, and from where) and must retain those logs for 90 days. Audit (Standard) would be the correct solution.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Purview eDiscovery (Standard)Correct answer▾
Why this is correct
Microsoft Purview eDiscovery (Standard) is specifically designed to address legal and investigative requirements by enabling organizations to identify, preserve, collect, and export electronically stored information (ESI). It allows legal teams to place immutable legal holds on content across Microsoft 365 services like Exchange, SharePoint, OneDrive, and Teams, preventing modification or deletion. Furthermore, it provides robust content search capabilities and the ability to export collected items in a defensible manner for external review, directly supporting the needs of a lawsuit.
✗Microsoft Purview Compliance ManagerWrong answer — click to see why▾
Why this is wrong here
Compliance Manager helps assess and manage compliance posture through controls and assessments, but it does not preserve, search, or export content for legal hold or eDiscovery.
★ When this WOULD be the correct answer
A compliance officer needs to assess the organization's compliance against regulatory standards (e.g., GDPR, ISO 27001) and track improvement actions. Compliance Manager would be the correct solution.
Why candidates choose this
Candidates may confuse 'compliance' broadly with legal preservation requirements, assuming Compliance Manager covers all compliance-related tasks including litigation holds.
✗Microsoft Purview Data Lifecycle ManagementWrong answer — click to see why▾
Why this is wrong here
Data Lifecycle Management focuses on retaining or deleting data based on policies, not on preserving data for legal hold, search, and export. It does not provide the preservation, search, and export capabilities required for litigation.
★ When this WOULD be the correct answer
A question asking for a solution to automatically retain emails for a specific period (e.g., 7 years) and then delete them, without needing legal hold or search/export capabilities, would make Data Lifecycle Management correct.
Why candidates choose this
Candidates may confuse data retention (Data Lifecycle Management) with legal preservation (eDiscovery), as both involve keeping data, but eDiscovery is specifically designed for legal contexts with hold, search, and export features.
✗Microsoft Purview Audit (Standard)Wrong answer — click to see why▾
Why this is wrong here
Audit (Standard) logs user and admin activities but does not preserve content in its original state or provide search/export capabilities for legal review; it only records metadata of actions.
★ When this WOULD be the correct answer
A compliance team needs to investigate a security incident by reviewing user activity logs (e.g., who accessed a file, when, and from where) and must retain those logs for 90 days. Audit (Standard) would be the correct solution.
Why candidates choose this
Candidates may confuse auditing (tracking actions) with eDiscovery (preserving and searching content), assuming that audit logs can serve as a substitute for preserving original documents.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
Key term
eDiscovery
eDiscovery is the process of identifying, collecting, and producing electronic information for legal cases or investigations.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.