Microsoft Purview Solutions for Compliance Requirements
You are a compliance administrator for Contoso, a multinational company that uses Microsoft 365. The company has the following requirements: 1. Automatically retain all documents containing personally identifiable information (PII) for 7 years. 2. Prevent users from sharing PII via email with external recipients unless they provide a business justification. 3. Monitor and alert when users access sensitive data outside of business hours. 4. Generate a compliance score for GDPR and ISO 27001. You need to configure the appropriate Microsoft Purview solutions. For each requirement, match the correct solution. Which combination of solutions should you use?
Quick Answer
The correct combination is Data Lifecycle Management for retention, DLP for sharing, Insider Risk Management for monitoring, and Compliance Manager for scoring. This works because Data Lifecycle Management applies automated retention policies to documents containing PII, while Data Loss Prevention (DLP) enforces user overrides for external sharing, Insider Risk Management detects abnormal access patterns outside business hours, and Compliance Manager generates compliance scores for frameworks like GDPR and ISO 27001. On the SC-900 exam, this question tests your ability to map specific Microsoft Purview solutions for compliance requirements to distinct business needs, often appearing as a matching scenario where common traps include confusing Information Protection labels (which classify, not retain) with retention policies, or mistaking Communication Compliance for access monitoring. A helpful memory tip is to think of the acronym “R-D-I-C”: Retention, DLP, Insider Risk, Compliance Manager—each addressing a core pillar of data governance, protection, detection, and scoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Lifecycle Management for retention; DLP for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring
Requirement 1 (retain PII for 7 years) is met by a retention label or policy from Data Lifecycle Management (not Information Protection, which is for classification). Requirement 2 (prevent sharing without justification) is met by a Data Loss Prevention (DLP) policy that can block sharing and require user override with business justification. Requirement 3 (monitor access outside business hours) is met by Insider Risk Management, which can detect anomalous access patterns. Requirement 4 (compliance score) is met by Compliance Manager. Option A is wrong because Information Protection labels are for classification, not retention; also monitoring access outside hours needs Insider Risk Management, not DLP. Option B is wrong because Communication Compliance is for monitoring communications, not for preventing sharing via email; DLP is needed for that. Option D is wrong because eDiscovery is for legal discovery, not for access monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Information Protection for retention; DLP for sharing; Data Lifecycle Management for monitoring; Compliance Manager for scoring
Why it's wrong here
Information Protection does not handle retention; Data Lifecycle Management does not monitor access.
- ✗
Data Lifecycle Management for retention; Communication Compliance for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring
Why it's wrong here
Communication Compliance is for communications, not DLP.
- ✓
Data Lifecycle Management for retention; DLP for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring
Why this is correct
All requirements are correctly mapped.
- ✗
Information Protection for retention; eDiscovery for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring
Why it's wrong here
Information Protection does not handle retention; eDiscovery is not for sharing prevention.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
eDiscovery
eDiscovery is the process of identifying, collecting, and producing electronic information for legal cases or investigations.
Key term
ISO 27001
ISO 27001 is an international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are the compliance administrator for a healthcare organization that must comply with HIPAA. You need to automatically detect and prevent patients' protected health information (PHI) from being shared via email. Additionally, you need to retain all emails containing PHI for 6 years. You also need to allow users to manually classify documents as 'Medical Record' with encryption that expires after 30 days. Which combination of Microsoft Purview solutions should you implement?
medium- ✓ A.Data Loss Prevention (DLP) policy to block PHI; retention policy for 6 years on emails containing PHI; sensitivity label with encryption and expiration
- B.Data Loss Prevention (DLP) policy to block PHI; eDiscovery to retain emails; sensitivity label with encryption
- C.Retention label for 6 years; sensitivity label with encryption; communication compliance to monitor sharing
- D.Data Loss Prevention (DLP) policy to block PHI; auto-labeling policy to apply retention label; no manual label needed
Why A: DLP policies detect and prevent sharing of PHI via email; a retention policy retains emails containing PHI for 6 years; a sensitivity label allows users to manually apply encryption with expiration. Option B is incorrect because eDiscovery is for search and export, not for retention; retention is handled by a retention policy, not eDiscovery. Option C is incorrect because communication compliance monitors for policy violations but does not prevent sharing; additionally, a retention label alone does not enforce retention (a retention policy or auto-apply label policy would be needed). Option D is incorrect because it lacks a manual label with encryption and expiration; auto-labeling can apply retention but not encryption with expiration.
Variation 2. You are the compliance administrator for Contoso, a multinational corporation with headquarters in the US and subsidiaries in Europe and Asia. Contoso uses Microsoft 365 E5 and Microsoft Purview. The company handles personal data subject to GDPR and CCPA. You need to design a compliance solution that meets the following requirements: - Automatically classify and protect documents containing personal data in SharePoint Online and OneDrive for Business. - Ensure that data subject requests (DSRs) for access and deletion can be fulfilled within the regulatory timeframes. - Prevent accidental sharing of sensitive data via email and Teams. - Maintain an audit trail of all activities related to personal data for at least one year. - Manage data retention to comply with local laws that require different retention periods for different types of data. Which combination of Microsoft Purview solutions should you use?
hard- ✓ A.Sensitivity labels with auto-labeling, DLP, eDiscovery, Data Lifecycle Management, and Audit (Premium)
- B.Insider Risk Management, DLP, eDiscovery, and Data Lifecycle Management
- C.Data Lifecycle Management, Information Barriers, DLP, and Audit (Premium)
- D.Sensitivity labels, Communication Compliance, eDiscovery, and Audit (Standard)
Why A: It includes all the necessary Purview solutions: Sensitivity labels with auto-labeling classify and protect documents containing personal data; DLP prevents accidental sharing via email and Teams; eDiscovery enables fulfilling data subject requests (DSRs) for access and deletion; Data Lifecycle Management allows configuring different retention periods for different data types; Audit (Premium) provides one-year audit trail retention. Options B, C, and D each miss one or more critical components needed to meet all requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.