SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization needs to audit all changes to sensitive files in SharePoint Online for at least 180 days. Which Microsoft Purview feature should be enabled?
⚠ Common exam trap
Watch out — candidates often confuse the 90-day default retention of standard audit with the extended retention of Audit (Premium), and mistakenly choose eDiscovery because it sounds like it involves logs, but eDiscovery is for content search, not audit log retention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Audit (Premium)
Microsoft Purview Audit (Premium) provides the extended retention of audit logs (up to 10 years) and the ability to search for high-value events such as changes to sensitive files. For a requirement of at least 180 days, Audit (Premium) is necessary because standard audit logs are retained for only 90 days. This feature logs all modifications to SharePoint Online files, including who changed what and when, meeting the auditing requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery is primarily designed for identifying, preserving, collecting, processing, reviewing, and exporting electronic data for legal or investigative purposes. While it can retrieve content, it does not generate or store the granular, continuous audit logs that record specific user or system actions on files. Its function is reactive content retrieval and analysis for litigation or investigations, not the proactive logging of every change or access event to sensitive data.
- ✓
Microsoft Purview Audit (Premium)
Why this is correct
Microsoft Purview Audit (Premium) is the correct solution because it provides advanced auditing capabilities specifically designed to capture and retain detailed user and admin activities across Microsoft 365 services. It offers extended retention of audit logs for up to one year (or 10 years with an add-on license) and access to crucial audit events like file and folder activities, enabling organizations to perform forensic investigations, respond to regulatory requests, and proactively monitor changes to sensitive files with high fidelity.
- ✗
Microsoft Purview Data Loss Prevention
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) is engineered to identify, monitor, and protect sensitive information by preventing its unauthorized sharing or transfer outside of defined boundaries. While DLP policies can detect when sensitive data is being moved or shared, its core function is policy enforcement and prevention, not the comprehensive logging and retention of all user and system activities on files for general audit purposes. DLP generates incidents when policies are violated, but it doesn't provide the detailed, continuous audit trail required to understand every modification or access event.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management (DLM) focuses on governing the retention and deletion of data within an organization based on regulatory, legal, and business requirements, ensuring content is kept for the necessary period and then appropriately disposed of. It manages the content itself, dictating its lifespan. While DLM is crucial for compliance, it does not generate or provide the detailed, immutable audit logs that record every change or access event to sensitive files; its scope is the content's lifespan, not the activity history of user interactions with that content.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.