SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization wants to automatically retain all customer emails for 7 years and then delete them. Which Microsoft Purview feature should you configure?
⚠ Common exam trap
SC-900 often tests the confusion between retention (lifecycle management) and eDiscovery holds—candidates may pick eDiscovery hold thinking it deletes data, but holds only preserve data indefinitely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Lifecycle Management retention policy
Microsoft Purview Data Lifecycle Management retention policies are designed to automatically retain and then delete content (e.g., Exchange emails, SharePoint files, Teams messages) based on a specified retention period. Configuring a retention policy with a 7-year retention period and a delete action after that period meets the requirement to retain customer emails for 7 years and then delete them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Lifecycle Management retention policy
Why this is correct
A Data Lifecycle Management retention policy is the correct solution because it allows an organization to define how long content should be retained and, optionally, when it should be deleted across various Microsoft 365 services. These policies can be applied broadly to entire locations, such as all Exchange mailboxes or SharePoint sites, ensuring automatic and consistent retention of all customer data according to organizational or regulatory requirements.
- ✗
Information Protection sensitivity labels
Why it's wrong here
Information Protection sensitivity labels are primarily used for classifying data, applying visual markings, and enforcing protective actions like encryption or access restrictions. While sensitivity labels can be configured to apply a retention label to content, their core function is not to establish an organization-wide, automatic retention policy for all customer data, nor do they directly define retention periods for content lifecycle management.
- ✗
Audit log retention
Why it's wrong here
Audit log retention specifically pertains to preserving records of user and administrator activities within Microsoft 365 services for security, compliance, and forensic investigations. It ensures that logs detailing who did what, and when, are kept for a specified period. This mechanism does not, however, retain the actual customer data content itself, such as emails, documents, or chat messages, making it unsuitable for managing the lifecycle of primary business data.
- ✗
eDiscovery hold
Why it's wrong here
An eDiscovery hold, also known as a litigation hold, is a legal preservation mechanism that prevents content from being permanently deleted until the hold is released. It is typically a targeted, reactive measure applied to specific custodians or content in response to a legal or investigative requirement. An eDiscovery hold does not establish proactive, time-bound retention periods or manage the eventual disposition of data across an organization, which is the purpose of a retention policy.
Go deeper
Related to this question
Learn chapter
Defender Vulnerability Management Basics
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.