SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization uses Microsoft Purview to manage data lifecycle. You need to ensure that after a project ends, all related files are automatically deleted after 3 years. What should you configure?
⚠ Common exam trap
It's easy for candidates to confuse sensitivity labels (which handle classification and protection) with retention labels (which handle lifecycle and disposition), leading them to choose Option D even though sensitivity labels lack native auto-deletion capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a retention label with a retention period of 3 years and a disposition action of deletion
A retention label in Microsoft Purview allows you to define a retention period and then automatically trigger a disposition action—such as permanent deletion—when that period expires. By creating a label with a 3-year retention period and setting the disposition action to 'Delete', all files tagged with that label will be automatically removed after three years, meeting the requirement without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a retention label with a retention period of 3 years and a disposition action of deletion
Why this is correct
Retention labels in Microsoft Purview are specifically designed to manage the lifecycle of data, including its eventual deletion. By creating a retention label with a 3-year retention period and a disposition action set to deletion, the organization ensures that content is preserved for the required duration and then automatically removed from its location. This mechanism is central to compliant data lifecycle management, enforcing policy across various Microsoft 365 services to meet regulatory and internal governance requirements.
- ✗
Configure a DLP policy to delete files after 3 years
Why it's wrong here
Data Loss Prevention (DLP) policies in Microsoft Purview are primarily focused on identifying, monitoring, and protecting sensitive information from unauthorized sharing or transfer outside the organization. While DLP can block actions, notify users, or encrypt content, it does not possess the functionality to automatically delete files after a specified time period. Its core purpose is to prevent data exfiltration and ensure data stays within defined boundaries, not to manage data retention or disposition.
- ✗
Create an eDiscovery case and manually delete the files
Why it's wrong here
eDiscovery tools within Microsoft Purview are utilized for identifying, preserving, collecting, processing, reviewing, and analyzing electronically stored information (ESI) for legal or investigative purposes. While eDiscovery cases can place content on legal hold to prevent deletion, they are not designed to automate the deletion of files as part of a routine data lifecycle management strategy. Manual deletion within an eDiscovery context would be an ad-hoc action, not a scalable or policy-driven solution for organizational data disposition.
- ✗
Apply a sensitivity label marked 'Project' and configure auto-deletion
Why it's wrong here
Sensitivity labels in Microsoft Purview are used to classify data and apply protective actions such as encryption, visual markings, and access restrictions based on the content's sensitivity. These labels are focused on data protection and governance, ensuring that sensitive information is handled appropriately regardless of where it resides. However, sensitivity labels do not include any built-in functionality or settings to configure automatic deletion of files after a specific period, as their purpose is distinct from retention and disposition.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Project
A project is a temporary endeavor with a defined beginning and end, undertaken to create a unique product, service, or result, managed through specific processes in IT environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.