SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
An organization is subject to regulatory requirements that mandate retention of employee records for 5 years after termination. After the retention period, the records must be permanently deleted. The compliance team wants to automatically enforce this process across all Microsoft 365 locations (Exchange, SharePoint, Teams). Which Microsoft Purview solution should they configure?
⚠ Common exam trap
Many candidates confuse Data Lifecycle Management with Records Management, but Records Management is for declaring records and managing their disposition (e.g., with a retention label), while Data Lifecycle Management provides the automated, policy-based retention and deletion across all locations without requiring manual labeling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Lifecycle Management
Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it allows organizations to define retention and deletion policies that apply automatically across Exchange, SharePoint, and Teams. This solution enforces the 5-year retention period after termination and then permanently deletes the records, meeting the regulatory requirement without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Data Loss Prevention (DLP)
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) is engineered to identify, monitor, and protect sensitive information across various Microsoft 365 services and endpoints. Its primary function is to prevent the unauthorized sharing or exfiltration of sensitive data, such as credit card numbers or personal identifiable information, by enforcing policies that block, warn, or encrypt. While DLP detects sensitive content, it does not provide mechanisms to define how long data should be retained or when it should be disposed of according to regulatory requirements.
- ✓
Microsoft Purview Data Lifecycle Management
Why this is correct
Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for managing content retention and deletion throughout its lifecycle. It enables organizations to create and apply retention policies that automatically preserve content for specified periods to meet regulatory, legal, or business obligations. Once the retention period expires, DLM ensures the content is permanently deleted, thereby addressing the question's requirement for mandated retention and eventual disposal.
- ✗
Microsoft Purview Records Management
Why it's wrong here
Records Management focuses on classifying and managing high-value records with legal requirements, but Data Lifecycle Management is the general tool for retention and deletion. However, Records Management builds on Data Lifecycle Management. For broad employee records, Data Lifecycle Management is more appropriate.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Microsoft Purview Communication Compliance is designed to help organizations detect, investigate, and act on inappropriate messages within their communication channels, such as Microsoft Teams or Exchange Online. It leverages machine learning to identify policy violations like harassment, threats, or regulatory non-compliance related to content. Its focus is on monitoring and remediating communication content for policy adherence, not on establishing or enforcing data retention and deletion schedules.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.