SC-900 Questions 51-60: Purview Information Protection, Retention, and Risk

The second half of SC-900’s compliance area is about protecting and governing information: sensitivity labels, data loss prevention (DLP), retention, records management, insider risk, eDiscovery, and audit. Each tool answers a different question, and the exam often describes a business need and asks you to pick the matching Microsoft Purview solution.

This is the sixth set in our SC-900 series (Questions 51-60), written for the skills outline that takes effect on October 21, 2026. It follows SC-900 Questions 41-50, which covered Compliance Manager and data classification. Every question is an original practice scenario, not a copy of a real exam item.

Choose your answer before you reveal it. Retention questions in particular reward careful reading, so check exactly what each scenario asks for.

Question 51: Protection That Travels With the File

A law firm wants documents about client mergers to be marked “Confidential” in the header and encrypted so that only firm employees can open them, even if a file is emailed outside the firm or copied to a USB drive. What should it use?

A) A retention label

B) A network security group

C) A sensitivity label that applies content marking and encryption

D) A Conditional Access policy

👁 Reveal Answer

Correct Answer: C

Explanation: Sensitivity labels classify and protect content. A label can add visual markings such as headers, footers, and watermarks, and it can encrypt the content so that only authorized people can open it. Because the label and its protection are stored with the file, the protection stays in place wherever the file goes. A controls how long content is kept or when it is deleted. B filters network traffic in Azure. D controls sign-in to apps, not access to a file that has already left the organization.

Reference: Learn about sensitivity labels

Question 52: Making Users Explain a Downgrade

After creating sensitivity labels, Contoso wants them to appear in users’ Office apps, wants new documents to start with the “General” label, and wants users to give a reason before they lower a label from “Confidential” to “Public.” Where are these settings configured?

A) In a sensitivity label policy that publishes the labels to users

B) In a DLP policy for Exchange

C) In a retention policy for OneDrive

D) In the Service Trust Portal

👁 Reveal Answer

Correct Answer: A

Explanation: Creating a label is not enough; labels reach users through label policies. A label policy chooses which users and groups see which labels and holds settings such as a default label, whether labeling is mandatory, and whether users must justify removing a label or lowering its classification. B prevents sensitive data from being shared inappropriately. C controls how long content is kept. D is Microsoft’s compliance documentation.

Reference: Learn about sensitivity labels

Question 53: Labeling Files Nobody Opens

Thousands of old files in SharePoint and OneDrive contain passport numbers, and most will never be opened again. The organization wants them labeled “Highly Confidential” automatically, without waiting for a user to open each file. What should it configure?

A) Ask users to review and label every file manually

B) Recommended labeling in Office apps, which suggests a label when a user edits a file

C) A retention label set to delete the files

D) An auto-labeling policy that applies the label to matching files stored in SharePoint and OneDrive

👁 Reveal Answer

Correct Answer: D

Explanation: Sensitivity labels can be applied automatically in two ways. Client-side labeling in Office apps applies or recommends a label while a user is working on a file. Service-side auto-labeling policies label content at rest in SharePoint, OneDrive, and Exchange without anyone opening it. Because these files will not be opened, only an auto-labeling policy reaches them. A does not scale. B only acts when someone edits a file. C would destroy data instead of protecting it.

Reference: Apply a sensitivity label to content automatically

Question 54: Stopping Card Numbers From Leaving

A payment company wants to stop employees from sending credit card numbers to people outside the company through email and Teams. Users should see a tip that explains why a message was blocked. Which solution fits?

A) Insider risk management

B) A data loss prevention (DLP) policy

C) Audit (Premium)

D) A retention policy

👁 Reveal Answer

Correct Answer: B

Explanation: DLP policies detect sensitive information, such as credit card numbers, in locations like Exchange, Teams, SharePoint, OneDrive, and devices, and then take actions such as showing a policy tip or blocking the sharing. A looks for patterns of risky behavior by users over time; it is not the tool for blocking a single message. C records activities after they happen. D keeps or deletes content and does not stop it from being shared.

Reference: Learn about data loss prevention

Question 55: Keep Every Teams Chat for Three Years

A regulator requires a bank to keep all Teams chat messages for three years. The requirement applies to every user, and no message should need to be tagged by hand. What should the bank configure?

A) A retention label that users apply to important chats

B) A sensitivity label with encryption

C) A retention policy for the Teams chats location, set to retain items for three years

D) A DLP policy for Teams

👁 Reveal Answer

Correct Answer: C

Explanation: Retention policies apply the same retention settings to whole locations, such as all mailboxes, sites, or Teams chats, which fits a blanket rule for every user. Retention labels work at the item level, and an item can have only one retention label at a time, so A would depend on users tagging chats. B protects content but does not keep it. D controls sharing, not retention.

Reference: Learn about retention policies and retention labels

Question 56: Contracts That Cannot Be Changed

Signed customer contracts must be kept for ten years, must not be edited or deleted during that time, and the protection must stay with each contract even if it moves to another SharePoint site. What should the records team use?

A) A retention label that declares the item a record, applied to each contract

B) A retention policy on the original SharePoint site

C) A sensitivity label with a watermark

D) An eDiscovery hold

👁 Reveal Answer

Correct Answer: A

Explanation: Only retention labels can declare an item as a record, which restricts editing and deletion, and the retention settings from a label travel with the content when it moves within the tenant. This is the basis of records management in Purview. B applies to the location, so its settings do not follow a contract that moves, and a policy cannot declare records. C marks content but does not lock it. D preserves content for a legal case and is not a long-term records solution.

Reference: Learn about retention policies and retention labels

Question 57: Two Settings That Disagree

A document is covered by a retention policy that deletes content after five years. A user also applied a retention label to it that retains content for seven years. What happens to the document?

A) It is deleted after five years, because the policy came first

B) It is kept for seven years, because retention wins over deletion and the longest retention period applies

C) It is kept forever, because the two settings cancel each other out

D) An error stops either setting from applying

👁 Reveal Answer

Correct Answer: B

Explanation: When several retention settings apply, Purview follows the principles of retention. First, retention wins over deletion, so content is not deleted while any setting still requires it to be kept. Second, the longest retention period wins. The document is therefore kept for seven years. A ignores the label’s retention. C and D describe behavior that does not exist; content does not stay forever, and multiple settings are expected.

Reference: Learn about retention (principles of retention)

Question 58: An Employee Who Is About to Leave

HR tells security that a senior engineer has resigned. The company wants to detect if he downloads unusual amounts of source code or copies it to personal cloud storage before his last day, using signals from HR systems and user activity. Which Purview solution fits?

A) Compliance Manager

B) A sensitivity label policy

C) Audit (Standard) search once a month

D) Insider risk management, using a data theft by departing users policy

👁 Reveal Answer

Correct Answer: D

Explanation: Insider risk management correlates signals such as HR events (for example, a resignation date) and user activity (downloads, copying to personal storage) to identify risky behavior, and it includes policy templates such as data theft by departing users. It is designed with privacy controls such as pseudonymized user names. A tracks compliance tasks. B labels content but does not watch behavior. C only finds events you already know to search for and does not correlate risk signals.

Reference: Learn about insider risk management

Question 59: Reviewing Evidence for a Lawsuit

A company’s legal team must preserve the mailboxes and OneDrive accounts of five employees for a lawsuit, then organize the results in a review set where reviewers can tag items, use OCR on images, and group email threads. Which option provides all of this?

A) Content search with export to a local folder

B) A retention policy on the five mailboxes

C) eDiscovery with premium features, which adds review sets, tagging, OCR, and conversation threading to cases, holds, and search

D) Activity explorer

👁 Reveal Answer

Correct Answer: C

Explanation: In the Microsoft Purview portal, eDiscovery is one experience organized around cases. Standard features include case management, holds, search, and export. Premium features, available with E5 or related add-on licenses, add review sets, tagging, OCR, conversation threading, analytics, and more. A is now part of eDiscovery and does not provide review sets. B keeps content but is not a legal hold workflow. D shows activity on labeled content.

Reference: Learn about eDiscovery in Microsoft Purview

Question 60: Which Mail Did the Attacker Read?

A mailbox was compromised nine months ago and the breach was only just discovered. Investigators need audit records from that time and want to know exactly which mail items the attacker accessed. What does the organization need?

A) Audit (Premium), which keeps Exchange audit records for one year by default and includes the MailItemsAccessed event

B) Audit (Standard), which keeps records for ten years by default

C) Activity explorer, which keeps 30 days of data

D) A DLP policy for Exchange

👁 Reveal Answer

Correct Answer: A

Explanation: Audit (Standard) retains records for 180 days, so nine-month-old events would be gone. Audit (Premium) retains Microsoft Entra ID, Exchange, OneDrive, and SharePoint records for one year by default (with a ten-year option through an add-on license) and provides intelligent insights such as the MailItemsAccessed event, which helps investigators see which mail items were accessed. B states the wrong retention period. C covers only 30 days and only labeled content. D prevents sharing; it does not investigate a breach.

Reference: Learn about auditing solutions in Microsoft Purview

Study Tips for Purview Information Protection and Risk

• Labels do different jobs. Sensitivity labels protect content. Retention labels keep or delete it and can declare records.
• Policies vs labels for retention. Policies cover whole locations. Labels cover single items and travel with them.
• Remember the principles of retention. Retention beats deletion, the longest retention wins, explicit beats implicit for deletion, and the shortest deletion period wins.
• Prevent, detect, investigate. DLP prevents sharing, insider risk management detects risky behavior, and eDiscovery and Audit support investigations.
• Know the audit numbers. Standard keeps 180 days. Premium keeps key workloads for one year by default.

Keep Practicing for SC-900

Go back to SC-900 Questions 41-50 for Compliance Manager and classification, then continue to Questions 61-70 on Azure infrastructure security, Defender for Cloud, and Microsoft Sentinel. The official SC-900 study guide lists every skill measured.