View Full Microsoft SC-401 Exam Dumps and Practice Test Dumps.

Question 101

Which Microsoft Purview feature can help identify sensitive information based on predefined patterns such as financial account numbers or government identifiers?

1. Sensitive information types
2. Adaptive Protection
3. eDiscovery
4. Audit retention

Correct Answer: 1

Explanation

Sensitive information types are classification patterns used by Microsoft Purview to identify specific categories of sensitive information. Built-in sensitive information types can recognize common data such as credit card numbers, bank account information, and government identification numbers. Administrators can use these detections in DLP, sensitivity labeling, auto-labeling, and other supported policies. Sensitive information types provide the foundation for many information protection scenarios because they help Microsoft Purview recognize data that requires additional controls. Organizations can also create custom sensitive information types for business-specific requirements.

Question 102

An organization has an internal employee identifier that does not match any built-in sensitive information type. What should the administrator create?

1. Retention label
2. Custom sensitive information type
3. Audit policy
4. Adaptive scope

Correct Answer: 2

Explanation

A custom sensitive information type allows administrators to define detection logic for information that is unique to an organization. An internal employee identifier may have a specific format or combination of keywords that is not adequately covered by Microsoft’s built-in sensitive information types. By creating a custom type, administrators can define appropriate detection conditions and then use the classification in supported DLP, labeling, or auto-labeling policies. This provides flexibility while allowing the organization’s information protection controls to recognize data that is specific to its own business processes.

Question 103

Which capability uses examples of documents to help Microsoft Purview recognize specific types of content?

1. OCR
2. Document fingerprinting
3. Audit search
4. Retention disposition

Correct Answer: 2

Explanation

Document fingerprinting allows organizations to create a recognizable representation of a structured form or document and use it to detect copies or versions of that document in supported content. This can be useful when an organization has standardized forms that contain sensitive information and wants to identify them when they are shared or stored elsewhere. Document fingerprinting differs from ordinary keyword or pattern matching because it is designed around recognizable document structures. It can then be incorporated into supported information protection and DLP scenarios.

Question 104

A company wants to detect sensitive information by comparing content against a protected list of known customer values. Which capability is designed for this requirement?

1. Trainable classifiers
2. Content Explorer
3. Exact Data Match
4. Activity Explorer

Correct Answer: 3

Explanation

Exact Data Match, or EDM, is designed to identify sensitive information by comparing detected content against a known set of exact values. This is useful when organizations have structured datasets containing sensitive customer, employee, or business information. EDM can provide more specific detection than generic patterns because it can match against known values from an organization’s data source. The reference information is prepared according to Microsoft’s supported EDM process, allowing Purview to use it for sensitive information detection while maintaining appropriate security controls around the source data.

Question 105

What is a major advantage of trainable classifiers compared with simple keyword-based detection?

1. They can identify content based on learned characteristics and examples
2. They automatically encrypt every detected file
3. They replace all DLP policies
4. They determine retention expiration dates

Correct Answer: 1

Explanation

Trainable classifiers can recognize content based on characteristics learned from representative examples rather than relying only on individual keywords or fixed patterns. This makes them useful for document categories that may contain different wording but share a common subject or structure. For example, business documents may discuss similar topics without using the same exact terms. Trainable classifiers can complement sensitive information types and other classification methods. They do not themselves replace DLP or retention policies; instead, their classification results can be used by supported Purview controls.

Question 106

An administrator needs to verify whether a sensitivity label policy is correctly targeted to a particular group of users. What should the administrator review?

1. DLP alert queue
2. Label publishing policy assignments
3. Audit retention period
4. eDiscovery hold

Correct Answer: 2

Explanation

Sensitivity labels become available to users through label publishing policies. When an administrator needs to verify whether a particular group can access a label, the policy’s assignments and targeted users or groups should be reviewed. A label can exist in the tenant without being available to every user. Reviewing publishing policy assignments helps administrators confirm whether the intended audience has been included and whether other users have been excluded. This targeted approach supports controlled deployment of sensitivity labels according to departmental or organizational requirements.

Question 107

Which sensitivity label setting can help ensure that users classify content before continuing with supported activities?

1. Mandatory labeling
2. Audit Premium
3. Adaptive scope
4. DLP alert

Correct Answer: 1

Explanation

Mandatory labeling can require users to apply a sensitivity label to supported content before proceeding with certain activities. This helps organizations improve classification consistency by reducing situations where users leave content unlabeled. Mandatory labeling can be particularly useful when an organization has established clear classification requirements for business information. Administrators should configure it carefully and provide appropriate labels so users can make meaningful classifications. Testing is also important because mandatory labeling can affect user workflows and may introduce friction if the available labels are not designed appropriately.

Question 108

An organization wants users to receive a predefined sensitivity classification automatically when creating supported documents unless they select another permitted label. Which setting should be considered?

1. Audit search
2. Default sensitivity label
3. eDiscovery hold
4. DLP simulation

Correct Answer: 2

Explanation

A default sensitivity label provides a predefined classification for supported content. This can help organizations establish a baseline classification without requiring users to start with an unlabeled document. Users may still have access to other permitted labels depending on the organization’s configuration and supported application behavior. Default labeling can improve classification consistency and reduce the number of documents that remain unclassified. Administrators should select a default label carefully because its protection settings, such as encryption or content marking, can influence how users work with the resulting content.

Question 109

Which sensitivity label feature can add a visible classification message to the header or footer of a document?

1. Content marking
2. Audit logging
3. Adaptive Protection
4. eDiscovery

Correct Answer: 1

Explanation

Content marking allows sensitivity labels to add visible indicators to supported documents. These can include headers, footers, or watermarks that communicate the classification of information to users. For example, a document classified as confidential can display a visible classification notice so users understand that additional care is required when handling it. Content marking provides a visual protection layer and can complement other label settings such as encryption or access controls. It does not itself determine retention periods or investigate user activity.

Question 110

An organization wants a sensitivity label to encrypt a document and restrict access to specific employees. Which label capability should be configured?

1. Data Explorer
2. Protection settings
3. Activity Explorer
4. Adaptive scope

Correct Answer: 2

Explanation

Sensitivity label protection settings can be configured to apply encryption and access restrictions to supported content. Administrators can specify who is permitted to access protected information and what rights those users receive, depending on the available configuration. This allows the organization to protect the content even after it leaves its original storage location. Protection settings are distinct from content marking because encryption controls access to the content, while markings provide visible classification information. Administrators should carefully define permissions so legitimate users retain the access required for their work.

Question 111

Which sensitivity label capability can help protect a Microsoft Teams team or Microsoft 365 Group by applying classification and supported container settings?

1. Container sensitivity labeling
2. Audit retention
3. Document fingerprinting
4. DLP simulation

Correct Answer: 1

Explanation

Container sensitivity labels can be applied to supported collaboration containers such as Microsoft Teams teams and Microsoft 365 Groups. Depending on the configured label settings, they can provide classification and influence supported container-level controls. This extends information protection beyond individual documents and emails to the collaborative spaces where users create and share information. Container labeling can help organizations establish consistent protection requirements for collaboration environments. Administrators should review the supported settings for each workload because container labels do not provide exactly the same behavior as labels applied directly to individual files.

Question 112

A compliance administrator wants to determine whether a specific retention policy applies to a user’s mailbox. Which capability should be used?

1. Content Explorer
2. Policy lookup
3. Trainable classifier
4. Message Encryption

Correct Answer: 2

Explanation

Policy lookup can help administrators determine which applicable retention configurations affect a specific user, location, or item. When troubleshooting mailbox retention, an administrator may need to determine whether a particular retention policy or label policy is responsible for the observed behavior. Policy lookup provides a focused way to investigate these settings rather than manually checking every policy. This can save administrative time and make retention troubleshooting more precise. Access should be limited to authorized administrators because the investigation may reveal information about organizational retention configurations.

Question 113

Which retention approach is most appropriate when different types of business records require different retention periods?

1. A single sensitivity label for all records
2. Retention labels
3. One DLP policy
4. One audit search

Correct Answer: 2

Explanation

Retention labels allow organizations to assign different retention requirements to different categories or individual items of content. For example, financial records, personnel records, and contracts may each require different retention periods. Applying appropriate retention labels provides more granular control than assigning one identical retention period to an entire workload. Retention labels can also support records management scenarios and other lifecycle requirements. Administrators should design labels around documented business and regulatory requirements and ensure that the labels are published to the users or locations that need them.

Question 114

A records manager wants retention to be determined dynamically according to user or site attributes rather than manually maintained membership lists. Which feature should be configured?

1. Adaptive scopes
2. OCR
3. Sensitivity label protection
4. DLP policy tips

Correct Answer: 1

Explanation

Adaptive scopes dynamically identify users, groups, or sites based on configured attributes and criteria. This allows supported retention policies to target changing organizational populations without requiring administrators to continually update static membership lists. For example, a retention policy can be associated with users who belong to a particular department or meet another supported attribute condition. When those attributes change, scope membership can change accordingly. This makes adaptive scopes useful in large or frequently changing organizations where manually maintaining policy targets would be time-consuming and prone to errors.

Question 115

What is one purpose of an auto-apply retention label policy?

1. Automatically assign a retention label when defined conditions are met
2. Automatically encrypt every email
3. Create an Insider Risk case for every user
4. Remove all expired content immediately

Correct Answer: 1

Explanation

An auto-apply retention label policy automatically applies a configured retention label when supported content meets specified conditions. This allows organizations to apply records management requirements consistently without depending entirely on manual user classification. The conditions should be carefully designed so that only appropriate content receives the retention label. Automatic retention labeling does not simply delete all matching content, and it is separate from sensitivity labeling. Administrators should test the configuration and review its impact before deploying it broadly across organizational content.

Question 116

Which Microsoft Purview capability can provide a structured workflow for investigating a potential insider risk alert?

1. Activity Explorer
2. Insider Risk Management case
3. Retention policy
4. Sensitivity label policy

Correct Answer: 2

Explanation

An Insider Risk Management case provides a structured environment for reviewing and managing a potential insider risk investigation. After relevant alerts are generated, authorized investigators can examine available information, document findings, and manage the investigation through the case workflow. This helps separate routine monitoring from formal investigation activities. A case does not automatically prove that a user has violated a policy; it provides a controlled mechanism for reviewing risk signals. Organizations should use appropriate permissions and investigation procedures to protect employee privacy and sensitive investigation information.

Question 117

An organization wants to detect risky behavior involving sensitive data and then investigate the associated activities through Insider Risk Management. What should be configured?

1. Insider Risk Management policy
2. Retention label
3. Content marking
4. Audit retention only

Correct Answer: 1

Explanation

An Insider Risk Management policy defines the conditions and indicators that Microsoft Purview uses to identify potentially risky insider behavior. Organizations can configure policies around scenarios such as sensitive data leakage or other activities that may indicate elevated risk. Once the policy is configured, relevant signals can contribute to risk detection and alerts, which authorized investigators can then review. This is different from retention labels, which govern information lifecycle requirements. Insider Risk Management focuses on identifying and investigating potentially risky user activities rather than controlling how long information is stored.

Question 118

Which Microsoft Purview capability can help security teams review activities associated with sensitive information and investigate how that information is being handled?

1. Retention disposition
2. Activity Explorer
3. Container labeling
4. Document fingerprinting

Correct Answer: 2

Explanation

Activity Explorer provides visibility into activities associated with classified and protected information across supported Purview scenarios. Security and compliance teams can use activity information to understand how users interact with sensitive content and investigate potentially unusual or risky events. This can help validate whether protection policies are producing the intended results and provide additional context during investigations. Activity Explorer is primarily a visibility and investigation capability. Enforcement actions such as blocking or restricting activities are handled by the applicable DLP and information protection policies.

Question 119

Which Microsoft Purview capability is intended to provide visibility into data security risks associated with organizational use of AI services?

1. DSPM for AI
2. Retention labels
3. Document fingerprinting
4. Audit retention policy

Correct Answer: 1

Explanation

DSPM for AI provides capabilities that help organizations understand and manage data security risks associated with AI services and AI interactions. It can provide visibility into relevant activity and help organizations identify areas where sensitive information may require stronger controls. DSPM for AI works alongside other Purview capabilities rather than replacing them. Organizations can combine its insights with sensitivity labels, DLP, auditing, and other controls to develop a broader AI data security strategy. This is increasingly important as employees use AI tools to process organizational information.

Question 120

A security team wants to investigate audit events related to a suspected data exposure incident. Which capability should the team use to search supported user and administrative activities?

1. Content Explorer
2. Audit
3. Retention label
4. OCR

Correct Answer: 2

Explanation

Microsoft Purview Audit provides searchable records of supported user and administrative activities across Microsoft services. During a suspected data exposure incident, investigators can use audit records to examine relevant events and establish a timeline of activities. This may help determine what actions occurred, when they occurred, and which accounts or services were involved, subject to the available audit data and retention period. Audit is therefore an important investigation capability, while Content Explorer is primarily focused on examining classified content rather than searching broad activity records.