Explanation:

Requirement 1 - Encrypt all email to fabrikam.com automatically
To force encryption for mail sent to a specific external domain (fabrikam.com):
You configure a mail flow rule (transport rule) in the Exchange admin center (EAC).
This rule can apply Office Message Encryption (OME) automatically when messages match conditions such as recipient domain.
Reference: Define mail flow rules to encrypt email messages
Correct choice: A mail flow rule in the Exchange admin center
Requirement 2 - Encrypted emails must expire after 7 days
To configure expiration and access control over encrypted emails:
You use Microsoft Purview sensitivity labels with encryption settings.
A label policy in the Purview portal can enforce encryption, set access rights, and define expiration (e.g., revoke access after 7 days).
Sensitive info types or mail flow rules cannot configure expiration.
Reference: Configure encryption settings for sensitivity labels
Correct choice: A label policy in the Microsoft Purview portal