Free SC-401: Administering Information Security in Microsoft 365 Exam Questions and Answers

You have a Microsoft 365 E5 subscription that contains a Microsoft Entra ID tenant. The Department attribute of each user is synced from Active Directory Domain Services. You plan to create a retention policy that retains Exchange Online mailbox content for 7 years for users whose Department attribute is Finance. Users move between departments frequently. You need to define which mailboxes are included in the policy. The solution must minimize administrative effort. What should you create?

• AA. A retention label policy that is published to the Finance mailboxes
• BB. An adaptive scope of type Microsoft 365 Group that queries the Department attribute
• CC. A static retention policy that targets the Finance distribution group
• DD. An adaptive scope of type User that queries the Department attribute

You have a Microsoft 365 E5 subscription that contains Microsoft Purview data loss prevention (DLP) policies for Exchange Online as shown in the following table. Policy | Order | Rule | Condition | Actions | Stop processing Policy1 | 0 | Rule1 | Content contains 1 or more U.S. Social Security Numbers | Show a policy tip to the sender | Yes Policy2 | 1 | Rule2 | Content contains 1 or more U.S. Social Security Numbers and recipient is outside the organization | Block the message | No Both policies are in the On state and apply to all users. A user sends an email message that contains one Social Security number to a recipient at an external domain. What will happen to the message?

• AA. The message is delivered with a policy tip, and Policy2 is not evaluated
• BB. The message is delivered with a policy tip, and Policy2 only generates an incident report
• CC. The message is blocked because the most restrictive action across both policies is applied
• DD. The message is blocked after Policy1 shows the policy tip to the sender

Your company has a Microsoft 365 tenant that contains the users shown in the following table. User | License User1 | Microsoft 365 E5 User2 | Microsoft 365 E3 User3 | Microsoft 365 E3 with the Microsoft 365 E5 Compliance add-on User4 | Microsoft 365 Business Premium The licenses have not changed in the last two years, and no audit retention policies have been created. Eight months ago, each user deleted a different file from a SharePoint Online site. You search the audit log in the Microsoft Purview portal for the file deletion activities of all four users. For which users will the search return the deletion activity?

• AA. User1 only
• BB. User1 and User3 only
• CC. User1, User2, and User3 only
• DD. User1, User2, User3, and User4

You have a Microsoft 365 E5 subscription. You create a sensitivity label named Project-Confidential and publish it to all users in a label policy. The label appears in Microsoft Word but not when users create a new Microsoft Teams team. You have already enabled sensitivity label support for Microsoft Entra ID groups and run Execute-AzureAdLabelSync. You need to ensure that users can select Project-Confidential when they create a team. What should you do?

• AA. Add the Groups & sites scope to Project-Confidential
• BB. Run Set-SPOTenant -EnableAIPIntegration $true
• CC. Enable the Encrypt option for Project-Confidential
• DD. Add Project-Confidential to an auto-labeling policy for SharePoint sites

You plan to use Security & Compliance PowerShell to create a data loss prevention (DLP) policy that applies to Exchange Online mailboxes and has one rule. Which cmdlet should you run first?

• AA. New-DlpComplianceRule
• BB. New-DlpCompliancePolicy
• CC. New-DlpSensitiveInformationTypeRulePackage
• DD. Set-DlpCompliancePolicy

You have a Microsoft 365 E5 subscription. Microsoft SharePoint Online sites contain scanned receipts saved as .jpg files. The receipts show credit card numbers. You create an auto-labeling policy for SharePoint that uses the Credit Card Number sensitive info type. The policy does not match any of the scanned receipts. You need to ensure that the sensitive info type can detect the credit card numbers in the images. What should you do?

• AA. Create a trainable classifier that is seeded with 50 sample receipt images
• BB. Add .jpg to the file types in the auto-labeling policy and run the policy in simulation mode
• CC. Create a custom sensitive info type that uses a keyword list of receipt file names
• DD. Configure OCR settings in the Microsoft Purview portal and link an Azure subscription for billing

You have a Microsoft 365 E5 subscription that contains two users named Admin1 and Admin2. Admin1 must create and publish sensitivity labels and configure auto-labeling policies. Admin2 must be able to view sensitivity label configurations and label policies but must not be able to change them. You need to assign Microsoft Purview role groups to the users. The solution must use the principle of least privilege. Which role groups should you assign?

• AA. Admin1: Information Protection Analysts; Admin2: Information Protection Analysts
• BB. Admin1: Information Protection Admins; Admin2: Information Protection Analysts
• CC. Admin1: Information Protection Admins; Admin2: Information Protection Admins
• DD. Admin1: Compliance Administrator; Admin2: Information Protection Analysts

You have a Microsoft 365 E5 subscription and an on-premises file server named FS1. You deploy the Microsoft Purview Information Protection scanner and create a content scan job for a share on FS1. A sensitivity label named Label1 is published and configured with an auto-labeling condition for credit card numbers. The condition is set to Recommend. The content scan job has the following settings: Enforce sensitivity labeling policy: On Label files based on content: On Treat recommended labeling as automatic: Off Relabel files: Off Default label: None You run the job. The scanner discovers files that contain credit card numbers, but none of the files are labeled with Label1. You need to ensure that the scanner applies Label1 to the files that contain credit card numbers. The solution must not label other files. What should you do?

• AA. Set Enforce sensitivity labeling policy to Off
• BB. Set Treat recommended labeling as automatic to On
• CC. Set Default label to Custom and select Label1
• DD. Set Relabel files to On

You have a Microsoft 365 E5 subscription. All devices are onboarded to Microsoft Defender for Endpoint and integration with Insider Risk Management is enabled. You need to detect users who attempt to bypass security controls, such as by disabling Microsoft Defender Antivirus or installing unapproved software. Which Insider Risk Management policy template should you use?

• AA. Risky AI usage
• BB. Data leaks by risky users
• CC. Data theft by departing users
• DD. Security policy violations

You have a Microsoft 365 E5 subscription that has Endpoint DLP enabled for 120 Windows 11 devices. Just-in-time protection is turned on for all devices. You need to ensure that if a file cannot be evaluated by just-in-time protection, users are prevented from accessing the file until evaluation succeeds. What should you configure?

• AA. The DLP policy mode set to Turn it on right away
• BB. The just-in-time protection fallback action set to Block
• CC. The Always audit file activity for devices setting set to On
• DD. A file path exclusion that includes the user profile folders