SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company has a SharePoint Online site that stores project documents. Due to legal requirements, all documents in this site must be retained for exactly 5 years from the date they were created, and then automatically deleted. No user should be able to permanently delete a document before the retention period ends. Which Microsoft Purview solution should the administrator configure?
⚠ Common exam trap
Candidates often confuse a retention policy with a sensitivity label or DLP policy, mistakenly thinking those can enforce time-based retention and deletion, when only a retention policy provides the necessary preservation lock and automatic deletion capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Retention policy
A retention policy in Microsoft Purview can be configured to retain documents for exactly 5 years from creation and then automatically delete them. This policy enforces a mandatory retention period that prevents users from permanently deleting documents before the period ends, meeting the legal requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Retention policy
Why this is correct
A retention policy in Microsoft Purview allows administrators to set a retention period (e.g., 5 years) and an action (such as automatic deletion) for content in SharePoint sites. Users cannot permanently delete the content until the retention period expires.
- ✗
Sensitivity label
Why it's wrong here
Sensitivity labels primarily classify data, apply visual markers, and enforce encryption or access restrictions based on the content's sensitivity. While they can be used in conjunction with retention policies to trigger auto-labeling or define scope, the label itself does not define or enforce the retention period or deletion action. Its core function is data protection and governance, not lifecycle management.
- ✗
Data loss prevention (DLP) policy
Why it's wrong here
Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various Microsoft 365 locations, preventing its unauthorized sharing or transfer. They achieve this by detecting specific sensitive info types and applying actions like blocking, auditing, or notifying users. DLP's purpose is to safeguard data from exfiltration or misuse, not to manage its lifecycle, such as enforcing how long content must be kept or when it should be deleted.
- ✗
Audit policy
Why it's wrong here
Audit policies are configured to record user and administrator activities within Microsoft 365 services, including SharePoint Online, to provide an immutable log for security investigations, compliance, and forensic analysis. These policies generate audit records detailing who did what, when, and from where. While crucial for accountability and compliance verification, audit policies are purely observational and do not directly dictate or enforce the retention or deletion schedules of the content itself.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Project
A project is a temporary endeavor with a defined beginning and end, undertaken to create a unique product, service, or result, managed through specific processes in IT environments.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company uses Microsoft Purview to manage records. You need to ensure that financial records are retained for 7 years and then permanently deleted. Which type of policy should you create?
easy- ✓ A.A retention policy with a retention period of 7 years and then delete
- B.A sensitivity label set to 'Financial' with auto-labeling
- C.A retention label that triggers a disposition review after 7 years
- D.A DLP policy that blocks sharing of financial records
Why A: A retention policy with a retention period of 7 years and then delete is correct because it applies a time-based retention rule to financial records at the container or folder level, ensuring they are kept for exactly 7 years and then permanently removed without human intervention. This meets the requirement for automatic deletion after the retention period, as opposed to a disposition review which requires manual approval.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.