Microsoft SC-401 Practice Test

SC-401 practice test: what's covered

• Information Protection - DLP - Retention - Insider Risk - Audit - DSPM for AI

Free SC-401 sample questions

1. A bank needs to detect national ID numbers only when the pattern appears near customer-account language, not whenever a similar number appears in a random export. What should the information security administrator build first?

   • A. A custom sensitive information type that combines a primary pattern with supporting evidence and confidence levels
   • B. A retention label that deletes every export file after seven business days
   • C. An insider risk policy that scores all exports from the finance department
   • D. A communication compliance policy that reviews every Teams message manually
   Show answer

   Correct: A. The requirement is classification accuracy, not retention or behavior scoring. A custom sensitive information type can combine a regex or keyword pattern with proximity evidence and confidence. Retention labels govern lifecycle, insider risk looks for risky behavior, and communication compliance reviews communications rather than classifying files for DLP.

2. An HR team wants Microsoft Purview to identify offer letters that do not follow a stable number pattern but have repeated document structure and wording. Which two classifier approaches are most relevant before creating DLP policies? (Choose two.)

   • A. Use document fingerprinting when the documents are based on a known template
   • B. Use a trainable classifier when examples can teach the service the document category
   • C. Use audit retention policies to increase alert visibility for offer letters
   • D. Use a Defender for Cloud Apps session policy as the document classifier
   Show answer

   Correct: A and B. Document fingerprinting fits forms and templates, while trainable classifiers fit categories that can be learned from example content. Audit retention affects how long audit data is kept, and a Defender for Cloud Apps session policy can control access but does not classify the document category by itself.

3. A legal department created sensitivity labels but users do not see them in Office apps. The labels exist in the portal and have encryption settings configured. What is the most likely missing step?

   • A. Publish the sensitivity labels through a label policy scoped to the intended users
   • B. Enable mailbox litigation hold for every user who needs the labels
   • C. Create an adaptive retention policy scope for the legal department
   • D. Turn on audit premium licensing before labels can appear in Office apps
   Show answer

   Correct: A. Creating a label is not enough; users receive labels through publishing policies that define availability and defaults. Litigation hold and retention scopes solve retention and preservation needs, while Audit Premium licensing does not publish sensitivity labels to Office clients.

4. An administrator needs a label that protects content and also marks the document with a visible footer. Which sensitivity-label settings should be reviewed together?

   • A. Encryption permissions and content marking settings for headers, footers, or watermarks
   • B. Retention duration and disposition review stage settings for the label
   • C. Audit retention duration and searchable audit activity categories
   • D. Insider risk indicators and alert threshold settings for the policy
   Show answer

   Correct: A. Sensitivity labels can apply protection such as encryption and content markings such as headers, footers, or watermarks. Retention labels manage lifecycle, audit retention controls audit data preservation, and insider risk indicators govern risk scoring rather than document protection and markings.

5. A SharePoint site contains highly confidential project files. The security team wants new files to be labeled automatically when content matches financial sensitive information. What should be configured?

   • A. An auto-labeling policy that targets the SharePoint location and matches the selected sensitive information types
   • B. A DLP policy tip that only warns users when they send email to external recipients
   • C. A retention policy that retains all SharePoint files for five years without classification
   • D. A Defender for Endpoint device group that blocks clipboard operations
   Show answer

   Correct: A. Auto-labeling policies can apply sensitivity labels based on conditions such as sensitive information type matches in supported locations. A DLP policy tip warns or enforces sharing behavior, retention does not classify content, and endpoint device groups do not label SharePoint content at rest.

Last updated: 2026-10-19

SC-401 practice test FAQ

Related practice tests

• Microsoft Purview DLP practice test
• Microsoft SC-300 practice test
• Microsoft SC-900 practice test
• Microsoft SC-200 practice test
• Microsoft MD-102 practice test
• Microsoft SC-400 practice test