SC-401: Information Security Administrator Practice Exam

What the SC-401 exam covers

• Implement information protection292 questions
• Implement data loss prevention and retention292 questions
• Manage risks, alerts, and activities292 questions

Free SC-401 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 876.

1. Question 1Implement information protection

   In Microsoft Purview, what are sensitivity labels used for?

   • ADetecting inappropriate messaging and policy violations in chat and email for compliance review
   • BPreserving mailbox and site content on legal hold so it cannot be altered during active litigation
   • CIndexing tenant content so that eDiscovery searches return relevant matching results quickly
   • DClassifying and protecting content (encryption, watermarking, access) based on sensitivityCorrect
   ✓ Correct answer: D

   Sensitivity labels in Microsoft Purview are the primary mechanism for classifying and protecting content throughout your organization. When a sensitivity label is applied to a document or email, it enforces configured protections including encryption that restricts who can open the file, usage rights that determine edit/copy/print permissions, and visual markings like watermarks or headers. These protections travel with the file even when shared externally, ensuring consistent data security regardless of location.

   Why the other options are wrong

   • ADetecting policy violations in messaging is the job of Communication Compliance, not sensitivity labels, which classify and protect files and email.
   • BPreserving content on hold is an eDiscovery and litigation-hold function, not the classification and protection role sensitivity labels perform.
   • CIndexing content for eDiscovery search is unrelated to sensitivity labels, which apply classification and protection such as encryption and marking.
2. Question 2Manage risks, alerts, and activities

   Insider Risk Management is producing many low-value alerts, raising review cost. Which adjustment improves signal quality most efficiently?

   • AConfigure the solution to raise an alert on every single user action
   • BTune policy thresholds and indicators to focus on meaningful risk signalsCorrect
   • CSet all indicators to their lowest sensitivity so that everything triggers
   • DDisable the insider risk management solution entirely to stop the alerts
   ✓ Correct answer: B

   Insider Risk Management generates low-value alerts when policy indicators are too sensitive, flooding the queue with mundane activities. Improve signal quality by tuning policy thresholds and indicators: adjust the risk score threshold so only higher-risk activities generate alerts, disable irrelevant indicators for the specific policy template, and adjust timeframes (for example, a high-volume download threshold from 50 files to 500 files) to match actual risk. This focuses investigation on genuinely concerning activities while reducing false positives and analyst fatigue.

   Why the other options are wrong

   • AAlerting on every action floods reviewers with noise, the opposite of tuning thresholds and indicators to surface meaningful risk.
   • CSetting indicators to trigger on everything lowers signal quality further; tightening thresholds and indicators is what reduces low-value alerts.
   • DDisabling the solution removes all detection rather than improving signal quality by focusing on meaningful risk indicators.
3. Question 3Implement data loss prevention and retention

   A DLP policy for Teams is configured but messages containing credit card numbers are still delivered to external federated users. What is the key limitation to understand?

   • ATeams DLP requires every participating device to be onboarded to Endpoint DLP first, so chat and channel messages are never inspected for sensitive information until device onboarding has fully completed, and messages to federated users bypass the policy entirely until then
   • BTeams DLP inspects only the voice and video call media streams between participants, so credit card numbers that a user types directly into a one-to-one or group chat message are never evaluated, matched, or blocked by any Teams DLP rule
   • CTeams DLP can retroactively scan the entire message history and locate and permanently delete every previously sent chat message that contained a credit card number across all internal, guest, and federated conversations in the tenant
   • DTeams DLP blocks messages in 1:1/group chats and channels for internal and federated/guest users it manages, but it acts on messages, not after they have already been sent in unsupported contexts; coverage depends on chat type and external access configurationCorrect
   ✓ Correct answer: D

   Teams DLP scans and can block or warn on messages in 1:1 chats, group chats, and channels for users it manages. It acts as messages are sent rather than retroactively, does not cover meetings or voice, and its coverage of federated or guest scenarios depends on chat type and external access settings, which is why some externally delivered messages are not blocked.

   Why the other options are wrong

   • ATeams DLP evaluates chat and channel messages independently of Endpoint DLP; device onboarding is not a prerequisite for inspecting Teams messages.
   • BTeams DLP inspects text messages in chats and channels, not voice or video streams, so it does evaluate typed credit card numbers.
   • CTeams DLP acts on messages as they are sent and cannot retroactively delete all previously sent messages across the tenant.
4. Question 4Implement information protection

   You want the Microsoft Purview Information Protection scanner to inventory a file share first and report what sensitive content it finds, without applying any labels or protection. How should you configure the content scan job?

   • ASet Enforce to Off so the scanner runs in discovery modeCorrect
   • BSet the default label to None on the job
   • CRemove the service account from the local Administrators group
   • DDisable auto-labeling policies in the compliance portal
   ✓ Correct answer: A

   A content scan job with Enforce set to Off runs the scanner in discovery-only mode: it crawls the repositories, evaluates sensitive information types, and populates reports without applying or changing labels. After reviewing the discovery reports you switch Enforce to On so labeling and protection are enforced. This staged approach validates policy impact before enforcement.

   Why the other options are wrong

   • BA default label of None affects which label unlabeled files receive when enforcing, not whether the run is discovery-only.
   • CThe service account still needs appropriate permissions to read the share; removing admin rights does not create discovery mode.
   • DThe scanner uses auto-labeling policies to know which labels to apply; disabling them does not produce a discovery report of findings.
5. Question 5Implement information protection

   A team wants to classify contract documents that share a distinctive language and style but contain no fixed keywords or patterns. Which Purview capability best identifies this content?

   • aA keyword dictionary sensitive information type
   • bAn exact data match schema built from a data table
   • cA trainable classifier that learns from samplesCorrect
   • dA regular expression pattern in a custom label
   ✓ Correct answer: c

   A trainable classifier is trained on positive and negative sample content and learns to recognize a category, such as contracts or resumes, by its overall language and structure. This suits content that has no reliable keywords, regular expressions, or exact values. Sensitive information types and exact data match instead rely on defined patterns, keywords, or precise values.

   Why the other options are wrong

   • aA keyword dictionary matches specific terms, which fails when content shares a style rather than a fixed vocabulary.
   • bExact data match compares content against precise values in an uploaded table, not the general style of a document.
   • dA regular expression matches a defined character pattern and cannot capture the loose language of contracts.
6. Question 6Implement data loss prevention and retention

   Which scope type should you choose for a retention policy so its membership stays current automatically as users change department or region?

   • AA static scope with manually selected locations.
   • BAn adaptive scope based on an attribute query.Correct
   • CA disposition review scope.
   • DA regulatory records scope.
   ✓ Correct answer: B

   An adaptive scope uses a query against user, group, or site attributes (such as department, country, or a SharePoint site property), and Microsoft Purview re-runs the query so membership adjusts as those attributes change. A static scope requires you to select instances manually and does not update on its own, which makes adaptive scopes better for large or frequently changing targets.

   Why the other options are wrong

   • AStatic scopes are fixed selections and do not update automatically.
   • CDisposition review is an end-of-retention approval step, not a scope type.
   • DRegulatory records is a record-marking capability, not a policy scope.
7. Question 7Manage risks, alerts, and activities

   Content Explorer can display an item as soon as it is created, even if the item has not been matched to any sensitive information type or label.

   • TrueTrue
   • FalseFalseCorrect
   ✓ Correct answer: False

   Content Explorer surfaces only items that have been classified by a sensitive information type, sensitivity label, or retention label. Content that carries no such classification does not appear, because Content Explorer is a view into the current state of classified data across the organization.

   Why the other options are wrong

   • TrueTrue is incorrect. The statement is false: Content Explorer surfaces only items that have been classified by a sensitive information type, sensitivity label, or retention label.
8. Question 8Manage risks, alerts, and activities

   After running an Audit (new) search job in the Microsoft Purview portal, you want to programmatically pull the same events on a schedule into a custom reporting database. Which is the recommended programmatic source?

   • AThe Office 365 Management Activity APICorrect
   • BThe Microsoft Graph Security alerts API
   • CThe SharePoint REST API
   • DThe Exchange Web Services (EWS) API
   ✓ Correct answer: A

   The Office 365 Management Activity API exposes the unified audit log as content blobs that applications can subscribe to and pull on a schedule, making it ideal for feeding a custom reporting database or analytics pipeline. The Search-UnifiedAuditLog cmdlet is the alternative scripted method.

   Why the other options are wrong

   • BThe Microsoft Graph Security alerts API surfaces security alerts and incidents, not raw unified audit log activity records.
   • CThe SharePoint REST API manages SharePoint content and configuration; it does not return tenant-wide audit log events.
   • DEWS accesses mailbox items and folders; it is not a source for the unified audit log.
9. Question 9Implement data loss prevention and retentionSelect all that apply

   A DLP rule uses the 'Content contains' condition with multiple sensitive information types. You want the rule to match if ANY one of several credit card SITs is found, but you also want a high-volume safeguard. Which two configuration choices are appropriate? (Choose two.)

   • AGroup the credit card SITs with OR logic so any single one triggers the ruleCorrect
   • BSet a minimum instance count on the SITs to avoid firing on a single incidental matchCorrect
   • CSet the rule to match only if all SITs are present using AND logic
   • DDisable confidence levels so every possible pattern matches
   ✓ Correct answer: A, B

   Joining several credit card SITs with OR ensures the rule triggers when any one is detected. Adding a minimum instance count (high-volume threshold) prevents one incidental number from firing the rule, improving precision. Together they meet the any-of plus safeguard requirement.

   Why the other options are wrong

   • CAND logic would require all SITs simultaneously, which is not the any-of intent.
   • DConfidence levels cannot simply be disabled, and matching every possible pattern would increase false positives.
10. Question 10Implement data loss prevention and retention

    A retention label includes file plan descriptors such as authority type, citation, and provision. A new analyst assumes these descriptors influence how long items are retained. What is the accurate statement about file plan descriptors?

    • AThey are organizational metadata for managing and filtering the file plan and do not affect retention or disposition behaviorCorrect
    • BThey override whatever retention period is defined on the label, so the authority type and citation values ultimately determine how long each labeled item is actually retained here
    • CThey determine which specific users and role groups in the tenant are permitted to apply the retention label to content, acting as a per-label permission control mechanism
    • DThey automatically place any item that receives the label onto a legal hold, because the provision and citation descriptors carry a built-in preservation obligation with them
    ✓ Correct answer: A

    Descriptors such as business function, category, authority type, provision, citation, and reference ID help records managers organize, justify, and filter labels in the file plan. They do not change how long an item is kept or what disposition occurs, which are configured by the label's retention settings. They are essentially documentation that maps a label back to a regulatory or business authority.

    Why the other options are wrong

    • BFile plan descriptors are informational metadata only; they do not override or alter the retention period defined on the label.
    • CDescriptors do not control who may apply a label; label application permissions are governed separately, not by authority type or citation values.
    • DDescriptors carry no enforcement behavior and do not place items on legal hold; they exist for organizing and filtering the file plan.

Related Microsoft resources

• SC-401 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

SC-401 practice exam FAQ