Microsoft SC-401 Practice Test

Answer choices

1. A. Use Audit Premium; audit logging pauses endpoint transfers until the event is searchable. Use a retention label with record locking; record retention is the JIT classification queue for endpoints.
2. B. Enable and scope Endpoint DLP just-in-time protection so supported egress can be temporarily blocked while classification and policy evaluation are pending. Use OCR; OCR always blocks file egress while every file in the tenant is being classified.
3. C. Enable and scope Endpoint DLP just-in-time protection so supported egress can be temporarily blocked while classification and policy evaluation are pending. Pilot JIT scope and user impact because the control intentionally favors protection during an evaluation gap and can temporarily block activity.
4. D. Use an eDiscovery hold; holds prevent a newly created endpoint file from being uploaded until DLP classification completes. Pilot JIT scope and user impact because the control intentionally favors protection during an evaluation gap and can temporarily block activity.

Wrong-answer review

• A. Use Audit Premium; audit logging pauses endpoint transfers until the event is searchable. Use a retention label with record locking; record retention is the JIT classification queue for endpoints.: Audit can provide searchable or retained event evidence for the activity described in 'Use Audit Premium', but those audit records do not become the source-content control needed to achieve 'Enable and scope Endpoint DLP just-in-time protection so supported egress can be temporarily blocked while classification and policy evaluation are pending. Pilot JIT scope and user impact because the control…'.
• B. Enable and scope Endpoint DLP just-in-time protection so supported egress can be temporarily blocked while classification and policy evaluation are pending. Use OCR; OCR always blocks file egress while every file in the tenant is being classified.: The endpoint behavior in 'Enable and scope Endpoint DLP just-in-time protection so supported egress can be temporarily blocked while classification and…' is limited by supported onboarded-device and JIT semantics and therefore cannot be generalized into the different scope implied by 'Enable and scope Endpoint DLP just-in-time protection so supported egress can be temporarily blocked while classification and policy evaluation are pending. Pilot JIT scope and user impact because the control…'.
• D. Use an eDiscovery hold; holds prevent a newly created endpoint file from being uploaded until DLP classification completes. Pilot JIT scope and user impact because the control intentionally favors protection during an evaluation gap and can temporarily block activity.: Using 'Use an eDiscovery hold' as the answer confuses eDiscovery search, hold, review, or export with the operational behavior required for 'Enable and scope Endpoint DLP just-in-time protection so supported egress can be temporarily blocked while classification and policy evaluation are pending. Pilot JIT scope and user impact because the control…'.

Answer choices

1. A. Use eDiscovery Manager as the mandatory DSPM policy-administration role.
2. B. Assign AI Administrator to every analyst and assume it grants unrestricted Purview content viewing by default.
3. C. Use the documented DSPM management and view-only roles, and grant AI-content or Content Explorer content-view permissions only to the limited reviewers who require prompt or response visibility.
4. D. Grant Global Administrator to every DSPM viewer because read-only posture roles do not exist.

Answer choices

1. A. The lowest-priority rule always wins because later-created rules override earlier rules.
2. B. All matched hosted-service rule actions are always summed together exactly like Endpoint DLP.
3. C. For hosted-service locations, evaluate rules in priority order and account for the documented most-restrictive-action behavior when multiple rules match.
4. D. Simulation-mode policies always take precedence over enforced policies when their rule number is lower.

Answer choices

1. A. Design the label taxonomy so users see labels appropriate to the supported workloads and protection outcome rather than using one container setting as a substitute for item protection.
2. B. Use a retention label for Teams privacy and guest-access settings because retention labels are the container-protection mechanism.
3. C. Create separate DLP policies for each label name because a sensitivity label itself cannot contain protection settings.
4. D. Apply a Groups & sites label to a SharePoint site and rely on it to encrypt every existing and future file in the site.

Answer choices

1. A. Use Policy Lookup and inspect both the location-wide retention policies and any item-level retention label before applying Purview retention precedence principles to the document.
2. B. Stop after identifying the location-wide policy; an item-level retention label cannot influence retention once a site is already included in a retention policy.
3. C. Assume the item-level label always shortens the effective retention period because item-level settings are more specific than location-wide policy settings in every case.
4. D. Assume the longest location-wide policy always controls even if the item has explicit label-based retention or record settings; item-level retention never changes the result.

Answer choices

1. A. Account for the fact that only the first triggered file policy's governance action is guaranteed when overlapping file policies match the same file.
2. B. Set the daily alert limit to zero; that disables all file-policy governance actions on matching files.
3. C. Use Audit Premium retention to tune file-policy alert thresholds; audit retention controls Cloud Apps governance.
4. D. Move the file policy to Endpoint DLP; endpoint policy mode directly changes Cloud Apps alert limits.

Answer choices

1. A. Enable and scope Microsoft Purview OCR so text can be extracted from supported images and then evaluated by the existing sensitive information types and classifiers. Configure document fingerprinting on each image extension because fingerprinting is the required OCR engine.
2. B. Replace every sensitive information type with a trainable classifier because OCR cannot feed existing classifiers. Validate licensing or pay-as-you-go requirements and supported locations before broad OCR rollout because OCR is an optional capability, not an automatic property of every Purview policy.
3. C. Enable a sensitivity label policy; publishing a label automatically performs OCR on all tenant images. Use Endpoint DLP JIT protection as the OCR service because JIT converts images to text before classification.
4. D. Enable and scope Microsoft Purview OCR so text can be extracted from supported images and then evaluated by the existing sensitive information types and classifiers. Validate licensing or pay-as-you-go requirements and supported locations before broad OCR rollout because OCR is an optional capability, not an automatic property of every Purview policy.

Answer choices

1. A. Use a Defender for Cloud Apps file policy; Cloud Apps governance is the direct control for local USB and printer activity.
2. B. Use a SharePoint container label to block removable-media copy; container labels are the endpoint activity engine.
3. C. Create an audit retention policy for FileCopied events; audit retention turns those historical events into real-time endpoint blocks.
4. D. Use endpoint activity controls to differentiate what is audited, blocked, or allowed instead of applying one generic cloud sharing action to every device event.

Answer choices

1. A. Use a DLP policy tip after the historical event; DLP tips are the Insider Risk Management case-notice template system.
2. B. Send an eDiscovery legal hold notification for every low-risk insider case; hold notices are the standard education workflow.
3. C. Use a customized Insider Risk Management notice template to send the approved reminder or guidance as part of the case workflow.
4. D. Close the case without documenting remediation because notice templates are only available before an alert is reviewed.

Answer choices

1. A. Enable a SharePoint container label; it installs File Explorer labeling support automatically on every joined Windows device.
2. B. Plan client deployment, permissions, supported file types, and labeling policy availability before relying on shell or PowerShell actions in production.
3. C. Use the Azure Information Protection unified labeling client for new deployments because it replaced the Purview Information Protection client.
4. D. Deploy only Endpoint DLP; Endpoint DLP includes all Purview Information Protection PowerShell cmdlets without the client.