Free Microsoft SC-401 Actual Exam Questions

Adding the Sensitive info type column ensures it appears; export is CSV by default.

Adding the Sensitive info type column is essential to show that data in the export. The file format is CSV since Microsoft 365 exports usually default to that for compatibility.

Option A, because installing the client is what activates protection on the devices.

Isn’t installing the Purview client just part of it? What about policy configuration?

It’s C for me. File1’s encrypted, so no. But File2’s label is published to User1, so they should have access, plus File3 is unrestricted even if not explicitly published.

It’s A for me. File1 is definitely out since it’s encrypted and User1 doesn’t have access. File3’s label is “General” which usually means no restrictions, but the table shows it’s not published to User1, so Copilot can’t summarize it. File2 has a label assigned and published to User1, so assuming User1 has at least read access, Copilot should be able to summarize File2. The key is that for Copilot to work, the label must be published to the user and permissions allow access, which fits File2 best here.

I’d pick creating a new template with plain text formatting since markdown might not be fully supported in the £5 plan. Using plain text avoids compatibility problems and fits with basic subscription limits.

I’d rule out using an existing template since insider risk scenarios often need custom messages. Also, plain text is less likely to cause issues across different email clients compared to markdown here.

First, create the trainable classifier itself. Then, publish it by associating with a sensitive info type or retention label. Lastly, configure the auto-apply label policy to use that classifier as a condition.

Before setting up the auto-apply label policy, you need to create the trainable classifier and then publish it as part of a sensitive info type or label. That way, the label can reference the classifier during auto-apply. So the order should be: create the trainable classifier, then create and configure the sensitive info type or label using that classifier, and finally set up the auto-apply retention label policy to apply based on that label. Skipping any of these steps breaks the chain for the classifier to trigger retention labels.

B imo, Activity explorer tracks detailed admin actions including label changes.

Reports (A) summarize changes well, so they’re suited for tracking label edits.

Looks like Windows 10 and Server 2019 devices support forensic evidence via Defender for Endpoint. For those, enabling advanced hunting and onboard to Defender would be key. Other devices probably can’t collect forensic data directly.

I’m thinking only Windows 10 and Server devices actually support forensic evidence collection natively here. For others like Android or iOS, there isn’t much Microsoft 365 can do for forensic data without extra tools.

A/D? You definitely need the HR data connector to mark the right users, but onboarding devices to Defender for Endpoint could help catch suspicious activity on those devices later. Still, first step is A for sure.

You gotta start with connecting HR data to identify users who resigned or are leaving, so A makes the most sense here. Without that, you can’t target the right people effectively. A

Policy Matches shows rules applied silently, so fits no alert requirement.

For rules without alerts, "Policy Matches" works since it shows matches ignored by alerts. The top 10 files need "File Matches" because it focuses on file-level hits. Miscategorized alerts fit "Alerts" report better.

B imo since a data leaks policy is crucial to define what to monitor, plus A because without the Purview extension, monitoring third-party AI sites isn’t possible. Intune (F) helps but isn't mandatory if devices are already managed somehow.

A and F, since the extension needs Intune for deployment and management.

I’m thinking Activity Explorer should show 4 matches because it logs every individual policy match without merging. For the incidents report, it usually groups matches by user and content within a timeframe, so if File3 triggered two policies but they got merged into one incident, that explains seeing 3 incidents instead of 4. The question doesn’t specify changing the default merging behavior, so it makes sense the incidents report reflects merged entries while Activity Explorer keeps them separate.

I’m with the idea that Activity Explorer will list each match separately, so that’s 4 matches total—one for each policy hit on File1, File2, and File3. For the incidents report, since the question doesn’t say anything about merging being turned off, it makes sense that incidents get grouped by file, meaning File3’s two matches count as one incident. That results in 3 incidents overall. So basically, Activity Explorer is more granular, showing every match, while the incidents report summarizes by grouping related matches into single incidents.

D imo, the View-Only Organization Management role is mostly tied to Exchange Online and wouldn’t cover auditing status across Microsoft Purview. Insider Risk roles (A and C) focus on risk investigations, which seems overkill and unrelated. B makes sense because Security Reader is designed for read-only access to security features, which would logically include auditing status. So, I’d skip the others since they either grant too many privileges or don’t fit the auditing context.

Option B makes the most sense since it’s designed for security-related read-only access across the tenant, which should include auditing info. The Exchange role is too narrow and risk roles are unrelated here.

Probably B, since triggered events usually keep 60 days max even with E5.

C imo, since advanced audit might boost data retention up to 90 days.

B assuming it only detects but doesn’t auto-encrypt without extra setup.

Probably A, mail flow rules can encrypt sensitive info in emails.

Starting with a sensitivity label makes sense to apply protection, but I’d skip exact data match if the info isn’t standardized. Custom sensitive info detection might catch more variations in confidential content here.

Creating the sensitivity label first is a must, for sure. For detection, I’d rule out generic keywords since confidentiality usually needs precise matching—exact data match seems more reliable here.