SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization needs to retain all customer communications data for 7 years due to regulatory requirements. Which Microsoft Purview solution should you use?
⚠ Common exam trap
Candidates often confuse eDiscovery (which holds data for legal cases) with retention policies, but eDiscovery holds are indefinite and not designed for scheduled lifecycle management, whereas Data Lifecycle Management is the correct tool for time-based regulatory retention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Lifecycle Management
Microsoft Purview Data Lifecycle Management (D) is the correct solution because it enables organizations to define retention and deletion policies for data, ensuring that customer communications data is retained for the required 7-year regulatory period and then securely disposed of. This solution directly addresses data retention requirements by applying policies at the workload level (e.g., Exchange Online, SharePoint) to manage the lifecycle of content based on specific rules, such as regulatory compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit primarily focuses on recording user and administrator activities across Microsoft 365 services, generating logs that detail who performed what action, when, and from where. While these audit logs are crucial for security investigations, compliance monitoring, and forensic analysis, they do not capture or retain the actual content of communications, such as the body of an email or the text of a chat message. Therefore, it cannot fulfill the requirement to retain the content of all customer communications for long-term archival or compliance purposes.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery tools are designed for the reactive process of identifying, preserving, collecting, reviewing, and exporting electronic information in response to legal cases, regulatory investigations, or internal inquiries. While eDiscovery can place content on legal hold to prevent its deletion, its core function is to facilitate the discovery and production of *existing* data, not to proactively establish and enforce retention policies for *all* customer communications from their creation. It relies on data already being available and discoverable, rather than ensuring its initial and ongoing retention.
- ✗
Microsoft Purview Data Loss Prevention
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) policies are engineered to identify, monitor, and protect sensitive information from being inappropriately shared, transferred, or used outside the organization. DLP focuses on preventing data exfiltration or misuse by detecting sensitive data types (e.g., credit card numbers, personal health information) and enforcing rules to block or audit their sharing. Its objective is to safeguard data against loss or unauthorized disclosure, not to proactively retain all customer communications for a specified duration to meet compliance or business retention requirements.
- ✓
Microsoft Purview Data Lifecycle Management
Why this is correct
Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for retaining all customer communications, as it provides comprehensive capabilities for managing the entire lifecycle of information. DLM allows organizations to create and apply retention policies and retention labels across various Microsoft 365 services, including Exchange, SharePoint, OneDrive, and Teams. These policies ensure that data is preserved for a specific duration to meet regulatory and business requirements, and then automatically deleted when its retention period expires, effectively governing both retention and disposition.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.