SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your company uses Microsoft Purview Data Lifecycle Management. You need to ensure that emails in users' mailboxes are retained for 7 years for compliance, but users should be able to delete emails they no longer need before that period. Which configuration achieves this?
⚠ Common exam trap
Candidates often confuse retention policies with holds or labels, assuming that any retention mechanism must block user deletion, but a retention policy without a preservation lock allows deletion while still retaining the data in the background.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a retention policy without a preservation lock
A retention policy without a preservation lock (Option D) allows you to define a retention period (7 years) for emails while still permitting users to delete items before that period ends. When a user deletes an email, it is moved to the Recoverable Items folder and retained for the remainder of the 7-year period, after which it is permanently deleted. This meets the compliance requirement without preventing user deletion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a Data Loss Prevention policy
Why it's wrong here
Configuring a Data Loss Prevention (DLP) policy is designed to identify, monitor, and protect sensitive information across Microsoft 365 services by preventing its unauthorized sharing or transfer. DLP policies focus on preventing data exfiltration or misuse based on content inspection, rather than defining how long data should be retained after a user deletes it or ensuring its recoverability for lifecycle management purposes. Therefore, DLP does not address the requirement for data retention and recoverability.
- ✗
Place a litigation hold on the mailboxes
Why it's wrong here
Placing a litigation hold on mailboxes is a legal preservation mechanism that prevents any content from being permanently deleted from a mailbox, regardless of user actions or other retention policies. While it ensures data is retained, it is an overly restrictive measure for the stated requirement, as it explicitly prevents users from deleting items even from their own view. The goal is to allow user deletion while maintaining recoverability, which a litigation hold directly contradicts by making items undeletable.
- ✗
Apply a retention label with record locking
Why it's wrong here
Applying a retention label with record locking designates an item as an immutable record, preventing anyone, including administrators, from modifying or permanently deleting it for the specified retention period. This level of strict immutability is typically reserved for regulatory compliance where absolute proof of non-tampering is required. This approach is too stringent for the scenario, as it would prevent users from deleting items, which is not the desired outcome.
- ✓
Apply a retention policy without a preservation lock
Why this is correct
Applying a retention policy without a preservation lock allows users to delete items from their primary view within applications like Outlook or SharePoint. However, the retention policy ensures that a copy of the deleted item is moved to a secure, hidden location (e.g., the Recoverable Items folder for Exchange, or the Preservation Hold library for SharePoint/OneDrive) and retained for the policy's duration. This mechanism precisely meets the requirement of allowing user deletion while guaranteeing the item remains discoverable and recoverable by administrators.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.