SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A multinational corporation must retain all financial records for 7 years and then permanently delete them. The compliance officer wants to ensure that even a global administrator cannot modify or delete the retention policy. Which Microsoft Purview solution and configuration should they use?
⚠ Common exam trap
Many exam-takers confuse retention policies with sensitivity labels or eDiscovery, not realizing that only a preservation lock provides the immutable, administrator-proof retention enforcement required for regulatory compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Lifecycle Management with a preservation lock
C is correct because Data Lifecycle Management with a preservation lock allows an organization to apply a retention policy that cannot be modified, deleted, or turned off by any administrator, including a global administrator. This ensures financial records are retained for exactly 7 years and then permanently deleted, meeting the compliance officer's requirement for immutable retention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
eDiscovery (Standard)
Why it's wrong here
eDiscovery (Standard) in Microsoft 365 is a tool primarily used for identifying, preserving, and collecting electronic content for legal or investigative purposes. While it can place content on "legal hold" to prevent deletion, this is a reactive measure for specific cases, not a proactive, automated system for managing the long-term retention lifecycle of *all* financial records across an organization. It does not define or enforce an organization-wide retention schedule.
When this WOULD be correct
A legal team needs to place a hold on all email communications related to an ongoing lawsuit to prevent deletion or alteration. eDiscovery (Standard) would be the correct solution to create a litigation hold and search for relevant content.
- ✗
Compliance Manager
Why it's wrong here
Microsoft Purview Compliance Manager is a workflow-based solution that helps organizations manage their compliance posture by providing assessments, recommended actions, and a centralized view of compliance activities. It assists in understanding and improving compliance with various regulations and standards. However, Compliance Manager itself does not directly implement or enforce data retention policies or perform automated deletion; it merely reports on and helps manage the state of compliance.
When this WOULD be correct
An organization needs to assess its compliance posture against regulatory standards (e.g., GDPR, ISO 27001) and track improvement actions. The compliance officer wants a dashboard showing compliance score and recommended actions.
- ✓
Data Lifecycle Management with a preservation lock
Why this is correct
Data Lifecycle Management (DLM), specifically through Microsoft 365 retention policies, allows organizations to define how long content is retained or deleted. For financial records requiring mandatory retention, a retention policy can be configured to preserve content for a specified period. Applying a preservation lock to this policy makes it immutable, preventing anyone, including administrators, from turning off the policy, deleting it, or making it less restrictive, thus ensuring compliance with stringent regulatory requirements for long-term record retention.
- ✗
Information Protection with sensitivity labels
Why it's wrong here
Microsoft Information Protection (MIP) sensitivity labels are primarily designed for classifying data and applying protective actions like encryption, visual markings, or access restrictions. While labels can *trigger* retention policies in some advanced scenarios, their core function is data classification and protection *at the time of creation or modification*, not the automated, long-term management of data retention or deletion lifecycle based on regulatory mandates. They do not inherently enforce the preservation of records for a specific duration.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Data Lifecycle Management with a preservation lockCorrect answer▾
Why this is correct
Data Lifecycle Management (DLM), specifically through Microsoft 365 retention policies, allows organizations to define how long content is retained or deleted. For financial records requiring mandatory retention, a retention policy can be configured to preserve content for a specified period. Applying a preservation lock to this policy makes it immutable, preventing anyone, including administrators, from turning off the policy, deleting it, or making it less restrictive, thus ensuring compliance with stringent regulatory requirements for long-term record retention.
✗eDiscovery (Standard)Wrong answer — click to see why▾
Why this is wrong here
eDiscovery (Standard) is used for searching and exporting content for legal or investigative purposes, not for enforcing immutable retention policies. It cannot prevent administrators from modifying or deleting retention settings.
★ When this WOULD be the correct answer
A legal team needs to place a hold on all email communications related to an ongoing lawsuit to prevent deletion or alteration. eDiscovery (Standard) would be the correct solution to create a litigation hold and search for relevant content.
Why candidates choose this
Candidates may confuse eDiscovery's hold capabilities with retention policies, assuming it can enforce long-term retention and deletion, but eDiscovery holds are temporary and not designed for compliance-based lifecycle management.
✗Compliance ManagerWrong answer — click to see why▾
Why this is wrong here
Compliance Manager is a risk assessment and compliance score tool, not a data retention solution. It cannot enforce retention policies or prevent modification/deletion of retention settings.
★ When this WOULD be the correct answer
An organization needs to assess its compliance posture against regulatory standards (e.g., GDPR, ISO 27001) and track improvement actions. The compliance officer wants a dashboard showing compliance score and recommended actions.
Why candidates choose this
Candidates may confuse 'compliance' in the name with the ability to enforce retention policies, or think Compliance Manager handles data lifecycle requirements.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.