SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your company is implementing records management for legal retention requirements. Documents must be locked and cannot be modified or deleted after a specific event. Which Microsoft Purview capability should you use?
⚠ Common exam trap
Many exam-takers confuse retention policies (which are flexible and can be modified) with regulatory record labels (which are immutable and locked), leading them to choose Option B thinking any retention mechanism will suffice for legal requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Retention label configured as a regulatory record
A retention label configured as a regulatory record is the correct choice because it enforces immutable, locked records that cannot be modified, deleted, or have their retention period shortened by any user, including administrators. This capability is specifically designed for legal retention requirements where documents must be preserved after a triggering event, using a policy that prohibits any changes or deletions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Retention label configured as a regulatory record
Why this is correct
A retention label configured as a regulatory record is the most stringent option for records management, specifically designed for legal or regulatory compliance. Once applied to an item, it renders the content immutable, preventing any modification, deletion, or even label removal by any user or administrator, including those with elevated permissions. This ensures the absolute integrity and immutability of the record, which is critical for legal discovery and regulatory obligations.
- ✗
Retention policy applied to a SharePoint site
Why it's wrong here
A retention policy applied to a SharePoint site targets the entire container or location rather than individual items. While it can ensure content is retained or deleted after a specified period, it does not inherently lock content as an immutable record. Users can typically still edit or delete items within the site, although a copy might be preserved in the Preservation Hold Library, which does not meet the strict immutability requirements of a regulatory record.
- ✗
Sensitivity label with encryption
Why it's wrong here
A sensitivity label with encryption is primarily focused on classifying data and protecting its confidentiality and access. While encryption prevents unauthorized access to the content, it does not prevent an authorized user from modifying the document's content or deleting the document entirely. Therefore, it fails to meet the core requirement of immutability and preservation for legal records management.
- ✗
Data Loss Prevention policy
Why it's wrong here
A Data Loss Prevention (DLP) policy is designed to identify, monitor, and protect sensitive information from being inappropriately shared outside or inside an organization. DLP actions typically involve blocking sharing, notifying users, or encrypting content upon sharing, focusing on data egress. However, DLP policies do not prevent an authorized user from modifying or deleting content within its original storage location, making them unsuitable for ensuring record immutability.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
Key term
Retention label
A retention label is a tag applied to emails, documents, or files in Microsoft 365 that tells the system how long to keep the item and what to do with it when the time is up.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.