CertifyDeckCargando contenido…
Microsoft · security
SC-401 (Information Security Administrator Associate) validates that you can plan and implement information security for sensitive data with Microsoft Purview and Microsoft 365 services: classify data with sensitive information types, document fingerprinting, EDM and trainable classifiers; create and publish sensitivity labels for items and containers; protect Windows, file shares and Exchange with the Information Protection client and scanner and Message Encryption; design data loss prevention policies, Endpoint DLP and Adaptive Protection; manage retention and data lifecycle; implement Insider Risk Management; investigate with Audit, Activity explorer and eDiscovery and respond to alerts; and protect data used by AI services with DSPM for AI. Skills outline in force since 28 October 2026.
No registration · No credit card
Question bank updated on October 28, 2026
Your company uses Microsoft Purview. You are creating a custom sensitive information type that must detect several thousand confidential product code names in multiple languages. The list changes every month, and you want to manage it without editing XML. What should you use as the primary element?
Your progress
The CertifyDeck SC-401 practice test includes 372+ original exam questions written from the official Microsoft Certified: Information Security Administrator Associate skills outline, each with the correct answer explained and available in English and Spanish.
Practice by domain with a free online test, take a timed 100-minute mock exam weighted like the real test and review your mistakes. Start for free, no sign-up or credit card, and try the practice test before deciding.
Official weighting per domain. Start for free, no sign-up.
Information security and Microsoft 365 compliance administrators experienced with Microsoft Purview and familiar with Microsoft 365, Microsoft Entra ID, Microsoft Defender XDR and Defender for Cloud Apps. No prerequisite certification.
SC-401 (Exam SC-401: Administering Information Security in Microsoft 365) is the exam for the Microsoft Certified: Information Security Administrator Associate certification. It checks that you can plan and implement security for sensitive data with Microsoft Purview and related services: protect information inside Microsoft 365 from internal and external threats, prevent data leaks, govern retention, manage insider risk, respond to alerts and protect the data used by AI services.
The skills outline in force from 28 October 2026 has three equally weighted areas: implement information protection (30–35%), implement data loss prevention and retention (30–35%), and manage risks, alerts, and activities (30–35%).
Information protection: built-in and custom sensitive info types, document fingerprinting, exact data match (EDM), trainable classifiers, OCR, Content explorer and Data explorer; sensitivity labels for items and containers (Teams, Microsoft 365 Groups, SharePoint sites and Power BI) with encryption, content marking, publishing policies and auto-labeling; the Microsoft Purview Information Protection client and scanner, and Message Encryption and Advanced Message Encryption in Exchange.
DLP and retention: designing data loss prevention policies, rule precedence, Adaptive Protection, file policies in Defender for Cloud Apps, and Endpoint DLP with its device requirements, advanced rules and just-in-time protection; retention labels and policies, adaptive scopes, Policy lookup and recovering retained content. Risks and alerts: Insider Risk Management (connectors, indicators, templates, forensic evidence, risk levels, cases and notice templates), Microsoft Purview Audit, Activity explorer, alerts in the Purview portal and Defender XDR, eDiscovery searches and DSPM for AI.
Microsoft requires no prior certification, but expects you to know Microsoft 365 services, PowerShell, Microsoft Entra, the Microsoft Defender portal and Defender for Cloud Apps. With that background, four to six weeks is usually enough: follow the Microsoft Learn path for SC-401 and use a Microsoft 365 E5 trial tenant to build labels, DLP and retention policies and an Insider Risk policy. If you come from [SC-900](/en/certifications/sc-900) you already have the core concepts, and [SC-300](/en/certifications/sc-300) and [SC-200](/en/certifications/sc-200) cover the identity and security operations around this role.
Start free to gauge your level and practice by area. The bank has more than 350 questions across the 3 domains and the 65 skill points of the 28 October 2026 outline, and the mock exam mirrors the real one with 50 questions in 100 minutes.
Official source: study guide SC-401 on Microsoft Learn
CertifyDeck is an independent study platform and is not affiliated with, endorsed by, or sponsored by Microsoft. SC-401 and its related marks belong to their respective owner.
You have 100 minutes to answer. Microsoft does not publish the exact number of questions: most of its exams have between 40 and 60, and there may be interactive components. Our mock exam uses 50 questions in 100 minutes.
You need 700 out of 1,000, as on every other Microsoft certification exam.
The fee depends on the country or region where the exam is proctored; in the United States, Microsoft Associate exams cost USD 165. CertifyDeck does not sell the exam, only the preparation: you can start free and full access is a one-time payment.
English, Spanish, German, French, Japanese, Portuguese (Brazil) and Chinese (Simplified). If it is not available in your preferred language you can request 30 extra minutes. On CertifyDeck every question and explanation is in English and Spanish.
No prior certification. Microsoft expects familiarity with all Microsoft 365 services, PowerShell, Microsoft Entra, the Microsoft Defender portal and Microsoft Defender for Cloud Apps.
Yes. The English version changes on 28 October 2026 with a minor update to sensitivity labels; the rest of the outline is unchanged. Localized versions are updated about eight weeks after the English one. Our bank already follows the 28 October 2026 outline.
One year. You renew it for free by passing an online assessment on Microsoft Learn.
No. They are original questions written from the official study guide and Microsoft's public documentation on Microsoft Purview and Microsoft 365.
Yes. You can start for free with no sign-up or card: SC-401 practice questions with explanations, a free online test by domain and published sample questions with answers. Full access to the whole bank and the timed mock exam is a one-off payment.
It is a good free starting point, but it is short and repeats the same items. A practice test with hundreds of original Microsoft Certified: Information Security Administrator Associate questions, timed mock exams and practice by domain tells you where you fail and whether you keep the level under time pressure.
Start for free, no sign-up or credit card.
Start free, no card
Start free, no card