SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization uses Microsoft Purview to manage records. For legal reasons, you need to preserve all documents related to a specific litigation case and prevent any modification or deletion. Which feature should you use?
⚠ Common exam trap
Candidates often confuse retention labels (which manage lifecycle) with legal hold (which freezes data for litigation), mistakenly thinking a retention label can prevent deletion immediately, whereas legal hold is the only feature that enforces an in-place, case-specific preservation hold.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
eDiscovery (Premium) legal hold
eDiscovery (Premium) legal hold is the correct feature because it preserves content in-place by placing a hold on data sources (e.g., Exchange mailboxes, SharePoint sites, OneDrive accounts) associated with a specific litigation case. This prevents any modification or deletion of documents while the hold is active, ensuring compliance with legal preservation requirements. Unlike retention labels, which manage lifecycle policies, legal hold is designed specifically for litigation scenarios to freeze data immutably.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Retention labels
Why it's wrong here
Retention labels are primarily used to manage the lifecycle of content, ensuring it is retained for a specific period and then disposed of according to policy. While a retention label can be configured to declare an item a 'record' or 'regulatory record' to prevent modification or deletion, this is a specific configuration, not an inherent function of all retention labels. Standard retention labels ensure content is kept but do not automatically lock it against user edits or deletions, making them insufficient for immediate, comprehensive preservation needs like those for legal discovery.
- ✓
eDiscovery (Premium) legal hold
Why this is correct
eDiscovery (Premium) legal holds are specifically designed to preserve content across various Microsoft 365 locations, such as Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams. When a legal hold is applied, it places an immutable preservation lock on all specified content, preventing users from modifying, deleting, or otherwise altering the data, even if a retention policy or label would normally allow it. This ensures that all relevant information is maintained in its original state for legal or investigative purposes, making it the most robust solution for preventing modification and deletion.
- ✗
Data Loss Prevention
Why it's wrong here
Data Loss Prevention (DLP) policies are designed to identify, monitor, and protect sensitive information from being shared inappropriately or accidentally deleted. DLP primarily focuses on preventing data exfiltration or unauthorized sharing by blocking, auditing, or encrypting content based on its sensitivity. It does not, however, provide a mechanism to preserve content in its current state or prevent its modification or deletion within its native storage location for compliance or legal hold purposes. Its function is about controlling data movement and access, not immutable preservation.
- ✗
Audit logs
Why it's wrong here
Audit logs in Microsoft 365 record user and admin activities across various services, providing a detailed trail of actions performed on content, such as who accessed, modified, or deleted an item and when. While crucial for forensic analysis and accountability, audit logs are purely reactive; they document events after they occur. They do not proactively prevent any modification, deletion, or alteration of content. Therefore, audit logs cannot fulfill the requirement of preventing content modification or ensuring its preservation.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.