Microsoft SC-401 Practice Test

Answer choices

1. A. Use eDiscovery review sets; review sets are the live telemetry feed for device DLP, within the documented operational, security, ownership, and validation requirements.
2. B. Use a sensitivity-label publishing policy; its status page is the authoritative log of endpoint copy and print activity, as the selected response to the described condition.
3. C. Allow for documented ingestion delay; Activity explorer is an investigation and reporting surface, not a real-time endpoint blocking console, as proposed.
4. D. Use Content explorer only; it is the real-time endpoint event stream and exposes all USB and print actions as they happen, for the required operational result and control objective.

Wrong-answer review

• A. Use eDiscovery review sets; review sets are the live telemetry feed for device DLP, within the documented operational, security, ownership, and validation requirements.: Using 'Use eDiscovery review sets' as the answer confuses eDiscovery search, hold, review, or export with the operational behavior required for 'Allow for documented ingestion delay; Activity explorer is an investigation and reporting surface, not a real-time endpoint blocking console.'.
• B. Use a sensitivity-label publishing policy; its status page is the authoritative log of endpoint copy and print activity, as the selected response to the described condition.: 'Use a sensitivity-label publishing policy' assigns sensitivity-label definition, publication, or automatic application a job that belongs to another stage of the labeling model, while 'Allow for documented ingestion delay; Activity explorer is an investigation and reporting surface, not a real-time endpoint blocking console.' uses the stage that actually owns the required behavior.
• D. Use Content explorer only; it is the real-time endpoint event stream and exposes all USB and print actions as they happen, for the required operational result and control objective.: The endpoint behavior in 'Use Content explorer only' is limited by supported onboarded-device and JIT semantics and therefore cannot be generalized into the different scope implied by 'Allow for documented ingestion delay; Activity explorer is an investigation and reporting surface, not a real-time endpoint blocking console.'.

Answer choices

1. A. Create a custom sensitive information type whose primary element matches the member number and whose supporting evidence, proximity, and confidence requirements distinguish it from inventory codes, within the stated policy framework.
2. B. Use a keyword dictionary as the primary element and ignore proximity because supporting evidence cannot affect confidence, within the documented operational, security, ownership, and validation requirements.
3. C. Use an Endpoint DLP setting to define the member-number regex because endpoint settings create tenant-wide sensitive information types, as the recommended implementation across the complete governed service lifecycle.
4. D. Configure a custom retention label with regex and confidence levels; retention labels provide the same classification engine, for the described technical objective and its associated operational control requirements, when applied.

Answer choices

1. A. Create a sensitivity-label policy for departing users; label assignment is the HR triggering event source, for the described technical objective and its associated operational control requirements, in context.
2. B. Use eDiscovery custodians as the connector; adding an employee to a case supplies all HR indicators to Insider Risk Management, for the stated implementation and support requirements.
3. C. Use Endpoint DLP device groups; device scope automatically imports performance reviews and resignation dates, within the documented scope, ownership, and validation boundaries.
4. D. Map the type of HR data collected to the selected policy template because different Insider Risk Management scenarios require different trigger data, within the described context.

Answer choices

1. A. Create an auto-apply retention label policy that attempts to label every item by a broad content condition; item-level labeling is required even when all content in the locations shares the same lifecycle.
2. B. Apply a retention policy to the selected locations with the required retain-then-delete settings, because the lifecycle is broad and location based rather than item specific, within the implement data loss prevention and retention (30%-35%) context.
3. C. Publish a five-year retention label and require users to apply it to every message and document in the selected locations; manual labeling is the normal mechanism for location-wide retention, for the stated security, delivery, and accountability requirements.
4. D. Create a default retention label for only new content and leave existing content governed by user choice; broad retention policies cannot cover existing Exchange or SharePoint content, for the stated implementation and support requirements.

Answer choices

1. A. Enable a SharePoint container label; it installs File Explorer labeling support automatically on every joined Windows device, as the primary proposed approach.
2. B. Plan client deployment, permissions, supported file types, and labeling policy availability before relying on shell or PowerShell actions in production.
3. C. Use the Azure Information Protection unified labeling client for new deployments because it replaced the Purview Information Protection client, for the stated scenario.
4. D. Deploy only Endpoint DLP; Endpoint DLP includes all Purview Information Protection PowerShell cmdlets without the client, for the required operational result and control objective.

Answer choices

1. A. Use file-policy alerts to investigate affected files and sharing context, then adjust the file policy's filters or governance action when the policy is too broad.
2. B. Create overlapping policies so every governance action is guaranteed to run in sequence on the same file, for the described technical objective and its associated operational control requirements, as configured.
3. C. Move the file policy to Endpoint DLP; endpoint policy mode directly changes Cloud Apps alert limits, as the selected approach for the stated technical and business outcome.
4. D. Use Audit Premium retention to tune file-policy alert thresholds; audit retention controls Cloud Apps governance, as the selected approach for the stated technical and business outcome, for review.

Answer choices

1. A. Use a tenant-wide compliance administrator assignment because sensitivity-label administration cannot be delegated through Purview role groups or scoped roles, for the described technical objective and its associated operational control requirements, for the affected environment.
2. B. Create a role group that includes both label administration and content-view permissions; viewing protected content is a prerequisite for publishing labels even when the team never investigates items, within the stated policy framework.
3. C. Use an eDiscovery management role scoped to the region; eDiscovery role groups are the supported administration path for sensitivity-label creation and publishing, within the implement information protection (30%-35%) context.
4. D. Use Purview role groups and scoped roles to grant only the label-management tasks the regional team needs, without adding unrelated tenant-wide or content-view privileges, under the documented operational and governance requirements.

Answer choices

1. A. Use DSPM posture and recommendations for aggregate risk and coverage, then drill into AI activities when investigators need event-level context, within the proposed design.
2. B. Use a sensitivity-label policy report; label publication is the authoritative AI activity event feed, for the described technical objective and its associated operational control requirements.
3. C. Use retention Policy lookup; it lists all AI apps, agents, prompts, responses, and posture recommendations, under the documented operational and governance requirements.
4. D. Use eDiscovery review sets as the default live DSPM dashboard; review sets continuously ingest all future AI activity automatically, as proposed.

Answer choices

1. A. The lowest-priority rule always wins because later-created rules override earlier rules, for the stated security, delivery, and accountability requirements.
2. B. All matched hosted-service rule actions are always summed together exactly like Endpoint DLP, under the organization’s defined implementation and exception-management process.
3. C. For hosted-service locations, evaluate rules in priority order and account for the documented most-restrictive-action behavior when multiple rules match, as the recommended response to this scenario.
4. D. Simulation-mode policies always take precedence over enforced policies when their rule number is lower, within the implement data loss prevention and retention (30%-35%) context.

Answer choices

1. A. Use a retention label to revoke a delivered external message; retention deletion removes the recipient's previously delivered encrypted copy, as the recommended implementation across the complete governed service lifecycle.
2. B. Test external recipient access and portal experience because Advanced Message Encryption controls affect how protected messages are consumed after delivery, within the defined security and accountability boundaries.
3. C. Use Audit Premium retention to expire the encrypted message when its audit event ages out, as the selected approach for the stated technical and business outcome.
4. D. Use Endpoint DLP JIT protection to revoke the delivered message; JIT protects endpoint egress, not recipient access to previously delivered email, in context.