Free SC-401 sample questions

Correct answer: Data classification > Trainable classifiers

Match/Not a match feedback for a trainable classifier's matched items is given in the Microsoft Purview portal from the classifier's matched-items view (Data classification > Classifiers > Trainable classifiers, select the classifier). The same feedback is also available in Content explorer and Data explorer, but that isn't one of the listed choices. Activity explorer shows labeling and DLP activity, and the auto-labeling page manages auto-labeling policies. Note that published custom classifiers can't be retrained; feedback helps tune accuracy. Source: Microsoft Learn, 'Increase classifier accuracy'.

Correct answers: Create an auto-labeling policy to apply the sensitivity label to all documents containing EHR data.; Create a sensitivity label that applies encryption and does not grant users the EXTRACT (Copy) usage right.

Microsoft 365 Copilot honors sensitivity label encryption through the EXTRACT (Copy) usage right. If a label applies encryption that grants users VIEW but not EXTRACT, Copilot won't summarize or return the content. An auto-labeling policy that detects EHR data applies that label reliably across existing and new documents. A DLP policy that only blocks sharing doesn't restrict Copilot. The Copilot-specific control is a DLP policy scoped to the 'Microsoft 365 Copilot and Copilot Chat' location with a sensitivity-label condition. Information barriers and retention policies don't control Copilot processing. Sources: learn.microsoft.com/purview/ai-m365-copilot-considerations and dlp-microsoft365-copilot-location-learn-about.

Microsoft 365 Copilot honors sensitivity label encryption through the EXTRACT (Copy) usage right. If a label applies encryption that grants users VIEW but not EXTRACT, Copilot won't summarize or return the content. An auto-labeling policy that detects EHR data applies that label reliably across existing and new documents. A DLP policy that only blocks sharing doesn't restrict Copilot. The Copilot-specific control is a DLP policy scoped to the 'Microsoft 365 Copilot and Copilot Chat' location with a sensitivity-label condition. Information barriers and retention policies don't control Copilot processing. Sources: learn.microsoft.com/purview/ai-m365-copilot-considerations and dlp-microsoft365-copilot-location-learn-about.

Correct answer: False

False. Whether a copy is kept in the Preservation Hold library depends on the retention settings. With retain-only or retain-and-delete settings, a file that's deleted during the retention period is copied to the Preservation Hold library. With delete-only settings nothing is preserved: the deleted document goes to the first-stage Recycle Bin, then the second-stage Recycle Bin, and is permanently deleted after 93 days. Source: Microsoft Learn, 'Learn about retention for SharePoint and OneDrive' (content paths for retain-only and delete-only settings).

Correct answer: Make sure the case documents have the 'Legal-Case-Final' label and 'Case-123' in their Asset ID property, then create an event of the event type associated with the label (for example, 'Case Closed') that specifies 'Case-123' as the asset ID.

In event-based retention, the event type is associated with the retention label when the label is created. Records managers apply the label to the content and, for SharePoint and OneDrive documents, enter an asset ID on each item. When the case closes, you create an event of that event type that specifies the asset ID (or keywords for Exchange items) and the date the event occurred. The event date is then synchronized to all content that has a label of that event type and the matching asset ID, which can take up to seven days. If you leave out the asset ID, every item with a label of that event type starts its retention period. Applying the label manually, publishing it, or auto-applying it with a 'Case-123' condition only puts the label on items; none of these creates the event that starts the retention period. Source: Microsoft Learn, 'Start retention when an event occurs'.

Correct answer: Supporting element

A sensitive info type pattern has four components: primary element, supporting elements, confidence level and proximity. Here the primary element is the regular expression for the TX ID. The keyword list with 'transaction' or 'payment' is a supporting element: Microsoft describes a supporting element as an element that acts as corroborative evidence and raises the confidence that a match is real. Character proximity only sets how many characters may separate the supporting element from the primary element (50 here). The confidence level (high, medium or low) reflects how much supporting evidence was found. Neither of them holds the keywords. Source: Microsoft Learn, 'Learn about sensitive information types' (pattern components).

Correct answer: The most restrictive policy (Policy A).

When multiple DLP policies are triggered for the same content in the same location, Microsoft Purview enforces the most restrictive policy. It does not simply aggregate them. The policy with the lowest priority order number (e.g., 0) is processed first, but the final action is determined by the most restrictive outcome among all matching policies. In this case, since Policy A is explicitly the most restrictive, its actions will be enforced on the email.

Correct answer: Microsoft Purview Information Protection scanner

The Microsoft Purview Information Protection scanner is designed specifically for discovering, classifying, and protecting files on on-premises data stores like file shares and SharePoint Server. It can be configured to run in discovery mode or enforcement mode to automatically apply sensitivity labels based on content inspection. Defender for Cloud Apps is for cloud services, the MPIP client is for user endpoints, and Endpoint DLP focuses on preventing data loss from managed devices, not bulk classification of file shares.

Correct answer: An audit log retention policy

Microsoft Purview Audit (Premium) allows the creation of specific audit log retention policies. These policies can be configured to retain logs for specific users, activities, or record types for longer periods (up to 10 years). This is the correct tool for applying different retention durations to different sets of users, such as the executive group. The default policy applies to everyone and cannot be customized in this granular way. eDiscovery holds and retention labels apply to user content, not audit logs.

Correct answer: Microsoft Purview Data Security Posture Management (DSPM) for AI

Requirement 4 specifically calls for continuously monitoring the data security posture for data used in AI workloads. This is the exact purpose of Microsoft Purview Data Security Posture Management (DSPM) for AI. DSPM is designed to discover sensitive data, evaluate its security posture, and detect risks like overexposure or drift in AI environments. Defender for Cloud Apps protects cloud apps, Insider Risk Management focuses on user behavior, and Audit is for logging activities, none of which directly address the AI data security posture requirement.

Correct answer: A Microsoft Purview Insider Risk Management policy using the 'Data theft by departing users' template and an HR connector.

Requirement 2 describes a classic use case for Insider Risk Management. The 'Data theft by departing users' policy template is designed for this exact scenario. To automate the process, an HR connector must be configured to feed employee resignation dates into Purview. This event automatically triggers the policy, which then analyzes the user's past activity for risky behaviors. A scheduled Content Search is a manual and less intelligent approach. A DLP policy is for prevention, not retrospective analysis of departing user behavior.