SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
An organization wants to automatically retain emails for 7 years and then delete them. They also need to place a legal hold on specific users' mailboxes to preserve all emails during litigation. Which combination of Microsoft Purview features should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Retention policies and Litigation Hold
For automatic retention and deletion, Retention policies in Microsoft Purview are ideal as they apply to entire mailboxes. To preserve emails for litigation, Litigation Hold can be enabled on specific user mailboxes, ensuring that no emails are deleted or altered. The combination of these two features meets both requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Retention labels and eDiscovery
Why it's wrong here
Retention labels can be used to apply specific retention and deletion periods to individual items or folders, fulfilling the "retain for 7 years and delete" requirement. However, eDiscovery is a process and a set of tools used for searching, identifying, and collecting electronically stored information (ESI) in response to legal requests. It does not inherently provide a mechanism to place a legal hold on content to prevent its deletion or modification, which is a separate and distinct functionality.
- ✓
Retention policies and Litigation Hold
Why this is correct
Retention policies are designed to automatically apply retention and deletion rules across entire locations, such as all Exchange mailboxes, directly addressing the requirement to "automatically retain emails for 7 years and then delete them." Litigation Hold, on the other hand, is a specific feature within Exchange Online that preserves all content in a user's mailbox indefinitely or for a specified period, overriding any retention policy deletions, to meet legal or compliance obligations. This combination effectively handles both automated lifecycle management and specific legal preservation.
- ✗
Data Lifecycle Management and Audit
Why it's wrong here
Data Lifecycle Management (DLM) is a broad framework within Microsoft Purview that encompasses the governance of data from creation to deletion, including retention policies. While DLM aligns with the goal of retaining and deleting emails, Microsoft Purview Audit (Standard/Premium) is a logging service that records user and administrator activities across Microsoft 365 services. Audit logs are crucial for forensic investigations and compliance reporting, but they do not provide any capability to actively retain content, prevent its deletion, or place a legal hold on data.
- ✗
Records Management and Data Loss Prevention
Why it's wrong here
Records Management in Microsoft Purview allows organizations to declare content as a record, which can enforce strict retention and immutability, but it's typically applied to specific, high-value content, not automatically to all emails for a general retention period. Data Loss Prevention (DLP) policies are designed to identify, monitor, and protect sensitive information from unauthorized sharing or exfiltration. Neither Records Management nor DLP offers the broad, automated retention and deletion capabilities required for all emails, nor do they provide the specific legal hold functionality needed to preserve content against deletion.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.