SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company is required by a compliance regulation to retain all user and admin activity audit logs for 2 years. They also need the ability to perform faster, historical searches on this audit data. Which Microsoft Purview solution should they use?
⚠ Common exam trap
Candidates often confuse the 90-day default retention of Audit (Standard) with the 2-year requirement, or mistakenly think Data Lifecycle Management or eDiscovery can fulfill audit log retention and search needs, when only Audit (Premium) combines long-term retention with high-performance historical search capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Audit (Premium)
Microsoft Purview Audit (Premium) provides a 2-year retention capability for audit logs, which meets the compliance regulation requirement. Additionally, it offers faster, historical searches through features like high-bandwidth access to the Audit Log Search API and intelligent insights, enabling efficient querying of large volumes of audit data. Standard Audit only retains logs for 90 days by default and lacks the performance optimizations for historical searches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Audit (Standard)
Why it's wrong here
Microsoft Purview Audit (Standard) provides basic auditing capabilities, retaining user and admin activity logs for a maximum of 90 days. While useful for short-term operational monitoring and troubleshooting, this default retention period is insufficient to meet compliance regulations requiring a two-year retention of audit data. Organizations needing longer retention periods for regulatory adherence must utilize a more advanced auditing solution.
- ✓
Microsoft Purview Audit (Premium)
Why this is correct
Microsoft Purview Audit (Premium) is the appropriate solution for retaining audit logs for two years, as it offers a default retention of one year, which can be extended to up to 10 years for specific activities. This service provides advanced auditing capabilities, including higher-fidelity logging, faster access to audit data, and increased API bandwidth, making it suitable for meeting stringent regulatory compliance requirements for long-term audit log retention.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management focuses on managing the retention and deletion of organizational content, such as emails, documents, and other files, based on defined policies. Its primary function is to govern the lifecycle of data assets within mailboxes, SharePoint sites, and OneDrive accounts, ensuring content is retained or disposed of according to business and regulatory needs, rather than managing the retention of audit logs themselves.
- ✗
Microsoft Purview eDiscovery (Premium)
Why it's wrong here
Microsoft Purview eDiscovery (Premium) is designed for legal and investigative purposes, enabling organizations to identify, preserve, collect, process, review, and export content relevant to legal cases or internal investigations. While eDiscovery can search *existing* audit logs and content, its role is not to *retain* audit logs for a specified compliance period. Instead, it acts as a tool to manage the discovery workflow for data that is already retained by other services.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Audit log
An audit log is a chronological record of security-relevant events and user activities within a system, used for monitoring, compliance, and forensic analysis.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.