SC-401 · Sample questions

SC-401 sample questions with answers and explanations

10 real questions from the CertifyDeck SC-401 bank, spread across the domains of the official Microsoft Certified: Information Security Administrator Associate skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.

1. Question 1Domain: Implement information protectionEasy

   Your company uses Microsoft Purview. You are creating a custom sensitive information type that must detect several thousand confidential product code names in multiple languages. The list changes every month, and you want to manage it without editing XML. What should you use as the primary element?

   • A.A keyword dictionary uploaded from a file
   • B.An exact data match table of code names
   • C.A document fingerprint of the product catalog
   • D.A keyword list defined inside the SIT pattern
   Show answer and explanation

   Correct answer: A. A keyword dictionary uploaded from a file

   Explanation

   Keyword dictionaries provide simpler management of keywords at a larger scale, support any language, and can be uploaded from a .csv or .txt file when you create or edit the SIT. Keyword lists are limited in size and, for SITs managed in PowerShell, require editing XML. A document fingerprint detects documents based on a form, not a list of terms, and exact data match needs a schema, hashing and a primary element that an existing SIT can discover.

   Official references

   • Create a keyword dictionary
2. Question 2Domain: Implement information protectionEasy

   During a pilot, you published a sensitivity label named Project Kestrel that applies encryption. Users must no longer be able to select the label, but content that already has the label must stay protected, and you must be able to make the label available again later. What should you do?

   • A.Edit the label to remove access control settings already applied to items
   • B.Remove the label from every label policy that includes it
   • C.Delete the label from the list of sensitivity labels
   • D.Move the label to the top of the label priority list
   Show answer and explanation

   Correct answer: B. Remove the label from every label policy that includes it

   Explanation

   Removing a label from its label policies stops users from seeing it in their apps, leaves the label and its protection on content that already has it, and lets you add it back later. Deleting the label is riskier: it cannot be done while the label is still in a policy, its protection template is archived, and you cannot create a new label with the same name.

3. Question 3Domain: Implement information protectionMedium

   You enable automatic scanning of new files for sensitivity labels in Microsoft Defender for Cloud Apps. Files created before you enabled the setting, and not modified since, don't show their Microsoft Purview sensitivity labels in Defender for Cloud Apps. You need these existing files to be scanned for labels. What should you do?

   • A.Republish the labels in the Microsoft Purview portal
   • B.Create a file policy that uses content inspection
   • C.Create an activity policy for file modification events
   • D.Clear the option to scan only labels from this tenant
   Show answer and explanation

   Correct answer: B. Create a file policy that uses content inspection

   Explanation

   Automatic scan doesn't scan existing files until they're modified again; to scan existing files for Purview labels you need at least one file policy that includes content inspection, for example with the Built-in DLP inspection method. The tenant-only option only controls whether labels set by external organizations are scanned, so it doesn't add existing files to the queue. Republishing labels or creating an activity policy doesn't trigger content inspection of existing files.

4. Question 4Domain: Implement information protectionEasy

   Your company plans to deploy the Microsoft Purview Information Protection client to all Windows computers. Users must be able to apply sensitivity labels while they work in Word and Excel. What provides sensitivity labeling inside Word and Excel after the deployment?

   • A.The Information Protection file labeler
   • B.The Information Protection viewer
   • C.The Office add-in that the client installs for each Office app
   • D.Sensitivity labeling built into Office apps
   Show answer and explanation

   Correct answer: D. Sensitivity labeling built into Office apps

   Explanation

   The Microsoft Purview Information Protection client has no Office add-in, because that functionality is replaced by sensitivity labels built into Office. The file labeler applies labels from File Explorer, not from inside Word or Excel, and the viewer only opens encrypted files.

   Official references

5. Question 5Domain: Manage risks, alerts, and activitiesMedium

   Your company integrates Microsoft Defender for Endpoint with Microsoft Purview Insider Risk Management. In the global settings, you select the New, In progress, and Resolved alert triage statuses for import. A Defender for Endpoint alert for a user moves through all three statuses. How many activities for this alert are imported for the user?

   • A.One activity, created only after the alert is resolved
   • B.Three activities, one for each triage status
   • C.Two activities, for the first and final statuses
   • D.One activity, created when the alert is new
   Show answer and explanation

   Correct answer: B. Three activities, one for each triage status

   Explanation

   When several triage statuses are selected, an activity is imported each time the alert's triage status changes to one of them, so investigators can follow the progression: one for New, one for In progress, and one for Resolved. Importing a single activity would happen only if just one of these statuses were selected.

6. Question 6Domain: Manage risks, alerts, and activitiesEasy

   Your company is enabling forensic evidence in Microsoft Purview Insider Risk Management. Insider risk administrators will request capturing for specific users, but members of the legal department must approve each request before any capturing occurs. To which role group should you add the legal department members?

   • A.Insider Risk Management Approvers
   • B.Insider Risk Management Admins
   • C.Insider Risk Management Investigators
   • D.Insider Risk Management Auditors
   Show answer and explanation

   Correct answer: A. Insider Risk Management Approvers

   Explanation

   Forensic evidence uses dual authorization: members of the Insider Risk Management or Insider Risk Management Admins role groups submit capturing requests, and members of the Insider Risk Management Approvers role group approve or reject them. Insider Risk Management Investigators can view captured clips, but they can't approve capturing requests.

7. Question 7Domain: Manage risks, alerts, and activitiesMedium

   Your company uses Insider Risk Management with a policy created from the Data theft by departing users template. When the HR connector reports a resignation date for a user, investigators must also be able to review that user's audit log activity from the weeks before the resignation was reported. Which setting should you adjust?

   • A.Past activity detection in Policy timeframes
   • B.File activity detection in Intelligent detections
   • C.Insider risk level timeframe in Adaptive Protection
   • D.Activation window in Policy timeframes
   Show answer and explanation

   Correct answer: A. Past activity detection in Policy timeframes

   Explanation

   Past activity detection sets how many days before a triggering event the policy gathers historic activity for the user, so the resignation date brings earlier audit log activity into scope. Activation window controls how many days after the triggering event the policy stays active for the user, so it does not add activity from before the resignation was reported.

8. Question 8Domain: Implement data loss prevention and retentionMedium

   In one Endpoint DLP rule, Access by restricted apps is set to Block for an app named ArchivePro, which is on the restricted apps list. The same rule includes a restricted app group that contains ArchivePro and is set to Apply a restriction to all activity with Audit only. A user opens a protected file with ArchivePro. What happens?

   • A.Access is allowed and audited, because the app group settings apply.
   • B.Access is blocked, because the most restrictive action in the rule wins.
   • C.Access is blocked, because the restricted apps list is evaluated first.
   • D.Access is blocked, and the user is offered an override with a reason.
   Show answer and explanation

   Correct answer: A. Access is allowed and audited, because the app group settings apply.

   Explanation

   When an app is on the restricted apps list and is also a member of a restricted app group in the same rule, the settings of the restricted app group override the restricted apps list. The group applies Audit only, so the user can open the file and the access is audited. The most-restrictive-wins logic applies when several policies match, not to this documented override between the list and the group inside one rule.

9. Question 9Domain: Implement data loss prevention and retentionMedium

   You need a retention policy that applies only to modern communication sites. Microsoft 365 group-connected sites and OneDrive sites must be excluded, and communication sites created in the future must be included automatically. Which adaptive scope should you create?

   • A.A SharePoint sites scope with the query SiteTemplate=SITEPAGEPUBLISHING
   • B.A Users scope that queries the Department attribute
   • C.A Microsoft 365 Groups scope that queries the group Display name attribute
   • D.A SharePoint sites scope with the query SiteTemplate=GROUP
   Show answer and explanation

   Correct answer: A. A SharePoint sites scope with the query SiteTemplate=SITEPAGEPUBLISHING

   Explanation

   SharePoint sites scopes include every site type, including group-connected and OneDrive sites, so you use a KeyQL query on the SiteTemplate property; SITEPAGEPUBLISHING identifies modern communication sites. SiteTemplate=GROUP would select exactly the group-connected sites that must be excluded. Microsoft 365 Groups and Users scopes target groups and users rather than communication sites.

10. Question 10Domain: Implement data loss prevention and retentionEasy

    Your company uses Microsoft Purview and a retention policy that retains Teams chat messages for seven years. A user deleted a chat message last month, and the legal team needs to find it. The message no longer appears in the Teams app. What should you use to locate the message?

    • A.The second-stage Recycle Bin of the user's OneDrive
    • B.An eDiscovery search of the user's mailbox
    • C.Activity explorer filtered by the user
    • D.The Preservation Hold library of the team's SharePoint site
    Show answer and explanation

    Correct answer: B. An eDiscovery search of the user's mailbox

    Explanation

    Data from Teams chats is stored in hidden folders of the participants' Exchange mailboxes, and retained messages move to the SubstrateHolds folder, where eDiscovery tools can search them. The Preservation Hold library and the Recycle Bin hold SharePoint and OneDrive files, not chat messages, and Activity explorer reports labeling and DLP activities rather than message content.