SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
An organization wants to automatically retain all financial documents for seven years and then delete them. Which Microsoft Purview solution should be used to create the retention policy?
⚠ Common exam trap
Candidates often confuse 'retention policies' with 'information protection' (labeling) or 'audit' (logging), but the SC-900 exam specifically tests that Data Lifecycle Management is the sole solution for automated retention and deletion based on time-based rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Lifecycle Management
Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it provides retention and deletion policies that can automatically retain data for a specified period (e.g., seven years) and then permanently delete it. This solution is designed specifically for managing the lifecycle of content across Exchange, SharePoint, OneDrive, and Teams, making it ideal for regulatory compliance requirements like financial document retention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection is designed for classifying, labeling, and protecting sensitive data across an organization's digital estate. It enables the identification of sensitive information types and the application of labels that can encrypt or restrict access to content. However, its primary function is data classification and protection, not the automatic scheduling or enforcement of retention periods for data lifecycle management.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit provides a unified logging solution that captures user and administrator activities across various Microsoft 365 services, such as Exchange Online, SharePoint Online, and Microsoft Teams. This service is crucial for forensic investigations, compliance reviews, and demonstrating accountability by recording 'who did what, when, and where.' While essential for monitoring and reporting, it does not offer capabilities to define, apply, or manage data retention or deletion policies.
- ✓
Microsoft Purview Data Lifecycle Management
Why this is correct
Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct service for automatically retaining and deleting content based on an organization's policies and regulatory requirements. It allows administrators to create retention labels and policies that can be applied to content across various locations, ensuring that financial data, for example, is kept for a specific duration and then disposed of appropriately. This directly addresses the need for automated retention scheduling to meet compliance obligations.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Microsoft Purview Communication Compliance helps organizations detect, investigate, and act on inappropriate messages or policy violations within internal and external communications. It utilizes machine learning to identify potential issues like harassment, threats, or the sharing of sensitive information across platforms like Microsoft Teams and Exchange. While vital for monitoring communication content for compliance, it is not designed to manage the lifecycle, retention, or deletion of data itself.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.