An organization must keep specified business content for a defined period and apply configured disposition behavior afterward. Which capability fits?

1. A password reset policy
2. Retention policies or labels appropriate to the workload
3. A firewall allow rule
4. A sensitivity label alone as the complete retention schedule