56 free Microsoft SC-401 practice questions from the CertStash pack of 280, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 56 free here, all 280 in the pack, and each step includes the one before it.
Get all 280 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
You have a Microsoft 365 E5 subscription that contains a Microsoft Teams channel named Channel1. Channel1 contains research and development documents.
You plan to implement Microsoft 365 Copilot for the subscription.
You need to prevent the contents of files stored in Channel1 from being included in answers generated by Copilot and shown to unauthorized users.
What should you use?
Show answer and explanation
Correct answer: D. sensitivity labels
Microsoft 365 Copilot only summarizes or references content that the requesting user is authorized to access, and it honors the encryption applied by sensitivity labels. Applying a sensitivity label with encryption to the Channel1 files restricts access to the authorized users defined in the label. Copilot checks the usage rights of the user who submits the prompt, and when that user has no rights to the file, the file content is not returned in the response. The protection travels with each file, so it applies wherever Copilot encounters the content.
Why the other options are wrong
- A. A DLP policy cannot be scoped to a single Teams channel and has no condition here that identifies the Channel1 files.
- B. Insider Risk Management detects risky user activity and does not control which content Copilot can return.
- C. Information Barriers restrict communication and collaboration between segments of users rather than protecting the content of specific files.
Question 2
You have a Microsoft 365 E5 subscription.
You need to create a sensitivity label named Label1. The solution must ensure that users can use Microsoft 365 Copilot to summarize files that have Label1 applied.
Which permission should you select for Label1?
Show answer and explanation
Correct answer: B. Copy and extract content (EXTRACT)
When a sensitivity label applies encryption, Microsoft 365 Copilot checks the usage rights of the user before it returns content from the item. Copilot can summarize the content only when the user is granted the EXTRACT usage right, shown in the Microsoft Purview portal as Copy and extract content (EXTRACT), together with VIEW. If a user has VIEW but not EXTRACT, Copilot does not summarize the content and can only reference it with a link. Including Copy and extract content in Label1 therefore allows Copilot to summarize labeled files.
Why the other options are wrong
- A. Export content allows saving the content in other formats and is not the right that Copilot checks before summarizing.
- C. Edit content allows users to modify the document and does not let Copilot extract content for a summary.
- D. View rights alone let Copilot reference the file with a link but not summarize its content.
Question 3
You have a Microsoft 365 E5 subscription.
You need to enable support for sensitivity labels in Microsoft SharePoint Online.
What should you use?
Show answer and explanation
Correct answer: A. the Microsoft Purview portal
Support for sensitivity labels in SharePoint and OneDrive is turned on from the Microsoft Purview portal, on the Sensitivity labels page of Information Protection, or with the Set-SPOTenant cmdlet and the EnableAIPIntegration parameter. Once enabled, SharePoint can process the content of labeled and encrypted Office and PDF files, which allows features such as search, co-authoring in Office for the web, eDiscovery, and auto-labeling policies to work with those files. The Microsoft Purview portal is therefore the tool to use.
Why the other options are wrong
- B. The Microsoft Entra admin center manages identities and access and has no setting for sensitivity label support in SharePoint.
- C. The SharePoint admin center does not contain the setting that enables sensitivity labels for files in SharePoint.
- D. The Microsoft 365 admin center manages users, licenses, and services and does not enable sensitivity label support for SharePoint.
Question 4
You have a Microsoft 365 subscription.
You need to customize encrypted email for the subscription. The solution must meet the following requirements.
Ensure that when an encrypted email is sent, the email includes the company logo.
Minimize administrative effort.
Which PowerShell cmdlet should you run?
Show answer and explanation
Correct answer: B. Set-OMEConfiguration
Branding for Microsoft Purview Message Encryption, including the logo, background color, and text shown to recipients, is stored in OME configurations. Running Set-OMEConfiguration against the default configuration with the Image parameter adds the company logo to every encrypted message without any further setup. This meets the requirement with the least administrative effort, because the default template already applies to all encrypted email.
Why the other options are wrong
- A. Set-IRMConfiguration controls tenant settings for Information Rights Management and does not set the branding shown in encrypted messages.
- C. Set-RMSTemplate changes the status of rights management templates and has no branding options.
- D. New-OMEConfiguration creates an additional custom template that must also be applied with a mail flow rule, which adds administrative effort.
Question 5
You have a Microsoft 365 E5 subscription.
You need to ensure that encrypted email messages sent to an external recipient can be revoked or will expire within seven days.
What should you configure first?
Show answer and explanation
Correct answer: A. a custom branding template
Message expiration and guaranteed revocation for encrypted email sent to external recipients are features of Microsoft Purview Advanced Message Encryption, and both depend on a custom branding template. Expiration is available only for messages that use custom branding, and the expiration period, such as seven days, is set in that template. Revocation is supported for messages sent with a custom branding template. The custom branding template is therefore configured first, and a mail flow rule then applies it to the messages that need it.
Why the other options are wrong
- B. A mail flow rule applies a custom branding template that must already exist, so it is not the first step.
- C. A sensitivity label encrypts content but does not provide the Advanced Message Encryption expiration and revocation for externally sent mail.
- D. A Conditional Access policy controls sign-in conditions and has no effect on the expiration or revocation of email.
Question 6
You have a Microsoft SharePoint Online site named Site1 that contains a document library. The library contains more than 1,000 documents.
Some of the documents are job applicant resumes. All the documents are in the English language.
You plan to apply a sensitivity label automatically to any document identified as a resume. Only documents that contain work experience, education, and accomplishments must be labeled automatically.
You need to identify and categorize the resumes. The solution must minimize administrative effort.
What should you include in the solution?
Show answer and explanation
Correct answer: A. a trainable classifier
Resumes are a type of document identified by their overall content rather than by a single pattern or value, which is what trainable classifiers recognize. Microsoft Purview provides a pretrained Resume classifier that detects documents describing work experience, education, and accomplishments, so it can be used in an auto-labeling policy without any training effort. This identifies and categorizes the resumes in the English language library while keeping administrative effort to a minimum.
Why the other options are wrong
- B. A keyword dictionary matches listed terms and cannot reliably recognize a resume as a whole document type.
- C. A function validates specific data formats such as dates or checksums and cannot categorize documents like resumes.
- D. An exact data match classifier matches known values from an uploaded table and does not recognize document types.
Question 7
You have a Microsoft 365 E5 subscription that contains a Windows 11 device named Device1 and three users named User1, User2, and User3.
You plan to deploy Azure Information Protection (AIP) and the Microsoft Purview Information Protection client to Device1.
You need to ensure that the users can perform the following actions on Device1 as part of the planned deployment:
• User1 will test the functionality of the client.
• User2 will install and configure the Microsoft Rights Management connector.
• User3 will be configured as the service account for the information protection scanner.
The solution must maximize the security of the sign-in process for the users.
What should you do?
Show answer and explanation
Correct answer: C. Exclude User2 and User3 from multifactor authentication (MFA).
The Rights Management connector and the Microsoft Purview Information Protection scanner do not support multifactor authentication. Microsoft states that the account that installs and configures the connector and the service account that runs the scanner must not require MFA. User2 installs and configures the connector and User3 is the scanner service account, so both must be excluded from MFA. User1 only tests the client, which supports MFA, so keeping MFA for User1 maximizes the security of the sign-in process.
Why the other options are wrong
- A. User1 tests the client and can keep MFA, while User3, the scanner service account, would still be required to use MFA.
- B. Passwordless authentication still requires strong interactive authentication, which the connector setup and the scanner service account cannot use.
- D. FIDO2 passkeys require interactive sign-in, which the connector installation account and the scanner service account cannot use.
Question 8
You have a Microsoft 365 subscription that uses retention label policies.
You need to identify all the changes made to retention labels during the last 30 days.
What should you use in the Microsoft Purview portal?
Show answer and explanation
Correct answer: B. Activity explorer
Activity explorer in the Microsoft Purview portal shows a historical view of labeling activity across the organization for up to the last 30 days. It records retention label activities such as a label being applied, changed, or removed, together with details such as the user, location, and time. Filtering Activity explorer on retention label activities identifies all the changes made to retention labels during the last 30 days.
Why the other options are wrong
- A. Reports summarize labeling and policy data in aggregate and do not list individual retention label changes.
- C. Content search finds content items in mailboxes and sites and does not track retention label activity.
- D. Use data search is not a Microsoft Purview tool for reviewing retention label activity.
Question 9
You have a Microsoft 365 E5 subscription that contains a user named User1.
You deploy Microsoft Purview Data Security Posture Management for AI (DSPM for AI).
You need to ensure that User1 can verify the auditing status of the subscription. The solution must follow the principle of least privilege.
To which role group should you add User1?
Show answer and explanation
Correct answer: D. View-Only Organization Management for Microsoft Exchange Online
In DSPM for AI, the view-only role groups, including Security Reader, can view the completion status of the getting started steps, except the status of Activate Audit. To view the status of Activate Audit, a user needs an additional Exchange role group, and View-Only Organization Management for Microsoft Exchange Online is the read-only option on that list. Adding User1 to this role group lets User1 verify the auditing status without granting permissions to change audit settings, which follows the principle of least privilege.
Why the other options are wrong
- A. Security Reader can view DSPM for AI, but it specifically excludes the status of Activate Audit.
- B. Insider Risk Management Analysts provides access to insider risk data and does not include viewing the Activate Audit status.
- C. Insider Risk Management Investigators grants access to insider risk cases and content and does not include viewing the Activate Audit status.
Question 10
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You recently discovered that the developers at your company emailed Azure Storage Account keys in plain text to third parties.
You need to ensure that when Azure Storage Account keys are emailed, the emails are encrypted.
Solution: You create a data loss prevention (DLP) policy that has Exchange email, SharePoint sites, OneDrive accounts, and Teams chat and channel messages selected.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Encrypting these emails requires a DLP rule for the Exchange email location that detects Azure Storage Account keys and uses the Encrypt email messages option of the Restrict access or encrypt the content in Microsoft 365 locations action. This solution only chooses a set of locations that mixes Exchange email with SharePoint sites, OneDrive accounts, and Teams chat and channel messages, and when several locations are selected, a rule can use only the conditions that those locations have in common. Creating the policy as described therefore does not ensure that the emails are encrypted. The goal is met by a DLP policy scoped to the Exchange email location with a rule that detects the keys and encrypts the messages.
Why the other options are wrong
- A. Mixing Exchange email with SharePoint, OneDrive, and Teams limits the rules to the conditions those locations share, and the solution sets up no rule that encrypts the emails.
What people say about the full SC-401 pack 5.0 from 2
Using Certstash for my SC-401 exam prep was the best decision. The materials were so on point that I passed on my very first try. I highly recommend them to anyone who is serious about getting certified.
Question 11
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You recently discovered that the developers at your company emailed Azure Storage Account keys in plain text to third parties.
You need to ensure that when Azure Storage Account keys are emailed, the emails are encrypted.
Solution: You create a data loss prevention (DLP) policy that has only the Exchange email location selected.
Does this meet the goal?
Show answer and explanation
Correct answer: A. Yes
A DLP policy scoped to the Exchange email location covers every message that users send. Its rule can use the Content contains condition with the built-in Azure Storage Account Key sensitive info type, together with a condition for content shared with people outside the organization. The action that restricts access or encrypts the content can encrypt email messages with Microsoft Purview Message Encryption, so any email that carries a storage account key is encrypted before it reaches the third parties. Email is the only channel in scope, so the Exchange location alone meets the goal.
Why the other options are wrong
- B. A DLP policy for Exchange email can detect Azure Storage Account Key content and apply message encryption, so the goal is met.
Question 12
You have a Microsoft 365 E5 subscription that has a sensitivity label named Sensitivity1.
You plan to create an auto-labeling policy that will apply Sensitivity1 to Microsoft Exchange Online mailboxes.
On February 1, you create the auto-labeling policy and enable simulation mode by using the default settings. No modifications are made to the policy in simulation mode.
When will the policy first be turned on?
Show answer and explanation
Correct answer: D. never
Simulation mode only reports which items would be labeled. It does not apply the label and does not move the policy to enforcement on its own. Microsoft offers a separate option to turn on the policy automatically if it is not edited for seven days, but that option must be selected when the policy is configured. With the default settings and no further action, the policy stays in simulation until an administrator turns it on, so it is never turned on automatically.
Why the other options are wrong
- A. A policy in simulation is not turned on after one day, because nothing in the default settings promotes it.
- B. February 6 does not match any automatic turn-on behavior, and the default settings do not turn the policy on.
- C. No two-week threshold turns on a simulated policy, and with default settings it remains in simulation.
Question 13
You have a sensitive information type based on a trainable classifier.
You are unsatisfied with the result of the trainable classifier.
You need to retrain the classifier.
What should you use in the Microsoft Purview portal?
Show answer and explanation
Correct answer: A. Content explorer from Data classification
Content explorer in Data classification is where the results of a trainable classifier are reviewed. It lists the items that the classifier has identified, so reviewers can open individual items and check whether each one truly belongs in the category. This review shows how accurately the classifier is identifying content and which items it is matching incorrectly. Of the listed tools, Content explorer is the only one that presents a classifier's matches for this kind of review when its results are unsatisfactory.
Why the other options are wrong
- B. Information Protection labels manage sensitivity labels and do not present the items that a classifier has matched for review.
- C. Information governance labels are retention labels and do not provide any review of classifier matches.
- D. Content search finds items for investigation and does not show or review the matches of a trainable classifier.
Question 14
You receive an email that contains a list of words that will be used for a sensitive information type.
You need to create a file that can be used as the source of a keyword dictionary.
In which format should you save the list?
Show answer and explanation
Correct answer: C. a CSV file that contains words separated by commas
A keyword dictionary for a sensitive info type can be built by uploading a file of terms, and the portal accepts dictionary files in TXT or CSV format. Saving the list as a CSV file with the words separated by commas produces a file that can be uploaded directly as the dictionary, which can then be used as an element of the sensitive info type.
Why the other options are wrong
- A. An Access ACCDB database is not accepted as a keyword dictionary file.
- B. A tab-separated TSV file is not one of the accepted dictionary file formats.
- D. An Excel XLSX workbook is not accepted, because the dictionary upload takes plain TXT or CSV files.
Question 15
You have a Microsoft 365 E5 subscription.
You need to create static retention policies for the following locations:
• Teams chats
• Exchange email
• SharePoint sites
• Microsoft 365 Groups
• Teams channel messages
What is the minimum number of retention policies required?
Show answer and explanation
Correct answer: B. 2
A single retention policy cannot include every supported location. When Teams locations are selected for a retention policy, the other locations are automatically excluded. However, Teams chats and Teams channel messages can be selected together in the same policy. One static retention policy therefore covers Exchange email, SharePoint sites, and Microsoft 365 Groups, and a second static policy covers Teams chats and Teams channel messages, for a minimum of two policies.
Why the other options are wrong
- A. Teams locations cannot be combined with Exchange, SharePoint, and Microsoft 365 Groups locations in one policy.
- C. Teams chats and Teams channel messages can share one policy, so a third policy is not needed.
- D. Exchange email, SharePoint sites, and Microsoft 365 Groups can share one policy, so four policies exceed the minimum.
- E. Locations can be grouped into two policies, so one policy per location exceeds the minimum.
Question 16
You need to test Microsoft Purview Advanced Message Encryption capabilities for your company. The test must verify the following information:
• The acquired default template names
• The encryption and decryption verification status
Which PowerShell cmdlet should you run?
Show answer and explanation
Correct answer: C. Test-IRMConfiguration
Test-IRMConfiguration is the Exchange Online PowerShell cmdlet used to verify a Microsoft Purview Message Encryption configuration. When it is run with a sender address, it reports whether the tenant acquired the Rights Management templates and lists the default template names, and then it runs encryption and decryption checks and reports a pass or fail status for each. That output matches both requirements of the test, so it is the cmdlet to run after setting up Advanced Message Encryption.
Why the other options are wrong
- A. Test-OAuthConnectivity checks OAuth authentication between Exchange and partner applications and reports nothing about encryption templates.
- B. Test-ClientAccessRule evaluates client access rules that control which protocols can connect to Exchange Online.
- D. Test-Mailflow tests message delivery between mailboxes or servers and does not verify encryption or decryption.
Question 17
At the end of a project, you upload project documents to a Microsoft SharePoint Online library that contains many files. The following is a sample of the project document file names:
• aei_AA989.docx
• bci_WS098.docx
• cei_DF112.docx
• ebc_QQ454.docx
• ecc_BB565.docx
All documents that use this naming format must be labeled as Project Documents.
You need to create an auto-apply retention label policy.
What should you use to identify the files?
Show answer and explanation
Correct answer: C. A sensitive info type
An auto-apply retention label policy identifies the content to label by using sensitive info types, keywords or searchable properties, or trainable classifiers. The project documents follow a strict, predictable naming format of three lowercase letters, an underscore, two uppercase letters, and three digits. A custom sensitive info type built on a regular expression describes that exact pattern, so it is the right way to identify the files and apply the Project Documents label automatically. No machine learning is needed for a fixed, rule-based pattern.
Why the other options are wrong
- A. A retention label is what the policy applies to the files, not the condition used to identify them.
- B. A trainable classifier learns the meaning of documents from sample content and is not suited to matching a fixed character pattern.
Question 18
Your company manufactures parts that are each assigned a unique 12-character alphanumeric serial number. Emails between the company and its customers reference the serial number.
You need to ensure that only Microsoft Exchange Online emails containing the serial numbers are retained for five years.
Which three objects should you create? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, F, G. an auto-labeling policy; a sensitive info type; a retention label
A custom sensitive info type defines the 12-character alphanumeric serial number pattern so that Microsoft Purview can detect it in email. A retention label holds the actual retention setting of five years. An auto-labeling policy for retention labels then applies that label automatically to Exchange Online messages that contain the sensitive info type. Together these three objects retain only the emails that contain serial numbers, rather than every message in the mailboxes.
Why the other options are wrong
- B. A retention policy applies to entire mailboxes and cannot target only emails that contain a serial number.
- C. A Data Loss Prevention policy controls sharing of sensitive content and does not retain email.
- D. A trainable classifier learns from sample documents, while a fixed serial number pattern is detected by a sensitive info type.
- E. A sensitivity label protects and classifies content and does not apply retention settings.
Question 19
You have a Microsoft 365 E5 tenant.
You need to add a new keyword dictionary.
What should you create?
Show answer and explanation
Correct answer: D. a sensitive info type
A keyword dictionary is a building block of a sensitive info type. In the Microsoft Purview portal, a new keyword dictionary is added while creating a custom sensitive info type, where the dictionary is defined as the primary element or as a supporting element of a pattern. The sensitive info type can then be used in DLP policies, auto-labeling and other classification features.
Why the other options are wrong
- A. A trainable classifier learns from sample documents and does not contain a keyword dictionary.
- B. A retention policy controls how long content is kept and does not define keyword dictionaries.
- C. A sensitivity label classifies and protects content and does not define keyword dictionaries.
Question 20
You have a Microsoft 365 subscription.
You need to monitor Microsoft 365 Copilot user prompts and responses for content that has been matched by the Protected Materials trainable classifier.
Which type of policy should you create?
Show answer and explanation
Correct answer: A. communication compliance
Communication Compliance policies can analyze Microsoft 365 Copilot interactions, meaning both the prompts that users enter and the responses that Copilot returns. A policy can use trainable classifiers as conditions, including the Protected Materials classifier, which detects known protected text such as copyrighted content in AI responses. Matches generate alerts that reviewers can investigate and remediate in Communication Compliance. This makes a Communication Compliance policy the correct choice for monitoring Copilot prompts and responses for content matched by that classifier.
Why the other options are wrong
- B. Data Loss Prevention policies block or audit sharing of sensitive content and do not provide a review workflow for Copilot prompts and responses.
- C. Insider Risk Management scores risky user activity patterns and does not review prompt and response content against classifiers.
- D. Retention policies keep or delete Copilot interactions and do not monitor or alert on their content.
Question 21
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a Microsoft 365 tenant and 500 computers that run Windows 11. The computers are onboarded to Microsoft Purview.
You discover that a third-party application named Tailspin_scanner.exe accessed protected sensitive information on multiple computers.
Tailspin_scanner.exe is installed locally on the computers.
You need to block Tailspin_scanner.exe from accessing sensitive documents without preventing the application from accessing other documents.
Solution: From the Microsoft Defender for Cloud Apps, you mark the application as Unsanctioned.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Marking an app as Unsanctioned in Microsoft Defender for Cloud Apps applies to cloud apps found through Cloud Discovery and is used to restrict access to those cloud services. Tailspin_scanner.exe is installed locally, and the unsanctioned tag cannot control which local files it opens, nor can it distinguish sensitive files from other files. The goal is met by adding Tailspin_scanner.exe to the restricted apps list in the Endpoint DLP settings and blocking the Access by restricted apps activity in a DLP policy for devices.
Why the other options are wrong
- A. The Unsanctioned tag applies to cloud apps and cannot stop a locally installed executable from opening sensitive files.
Question 22
You have a Microsoft 365 E5 subscription.
You create a sensitivity label named Label1 and publish Label1 to all users and groups.
You have the following files in a SharePoint site:
• File1.doc
• File2.docx
• File3.xlsx
• File4.txt
You need to identify which files can have Label1 applied.
Which files should you identify?
Show answer and explanation
Correct answer: B. File2.docx and File3.xlsx only
Sensitivity labels for files in SharePoint Online are supported for the modern Office Open XML formats of Word, Excel, and PowerPoint, such as .docx, .xlsx, and .pptx. File2.docx and File3.xlsx use these formats and can have Label1 applied. File1.doc uses the older binary Word format, and File4.txt is plain text, and neither is a supported Office file type for applying a sensitivity label in SharePoint, so only File2.docx and File3.xlsx qualify.
Why the other options are wrong
- A. File3.xlsx is an Excel Open XML file and supports sensitivity labels, so it must be included.
- C. File1.doc is a legacy binary Word file that is not supported for labeling in SharePoint.
- D. File1.doc and File4.txt are not supported Office file types for sensitivity labels in SharePoint.
Question 23
You have a Microsoft 365 E5 subscription that uses Microsoft Purview.
You are evaluating the use of custom data assessment scans to identify the potential oversharing of data in the subscription.
What is the maximum number of items the data assessments can support per location?
Show answer and explanation
Correct answer: C. 200,000
Data risk assessments in Data Security Posture Management identify potential oversharing in locations such as SharePoint sites. Microsoft documents that these assessments support a maximum of 200,000 items per location, and this limit applies to both custom and default data risk assessments. Microsoft also notes that the count of files reported might not be accurate when a location has more than 100,000 files, but the supported maximum per location is 200,000 items.
Why the other options are wrong
- A. 50,000 items is lower than the documented maximum of 200,000 items per location.
- B. 100,000 items is the point beyond which file counts might be inaccurate, not the maximum supported.
- D. 500,000 items exceeds the documented maximum of 200,000 items per location.
Question 24
You have a Microsoft 365 subscription that contains 100 users and a Microsoft 365 group named Group1.
All users have Windows 11 devices and use Microsoft SharePoint Online and Exchange Online.
A sensitivity label named Label1 is published as the default label for Group1.
You add two sublabels named Sublabel1 and Sublabel2 to Label1.
You need to ensure that the settings in Sublabel1 are applied by default to Group1.
What should you do?
Show answer and explanation
Correct answer: A. Modify the policy of Label1.
The default label is not a property of the label itself but a setting in the label policy that publishes it. Label1 is currently selected as the default in that policy, and now that Label1 has sublabels, the policy must be edited so that Sublabel1 is chosen as the default. Modifying the policy of Label1 therefore makes the settings of Sublabel1 apply by default to Group1 without recreating labels or policies.
Why the other options are wrong
- B. Copying settings into Label1 leaves Label1 as the default, and a label that has sublabels acts as a container for them rather than as the label users receive.
- C. Deleting the policy unpublishes the labels for Group1, and the default label is chosen inside a policy setting rather than by publishing a sublabel alone.
- D. The order of a sublabel sets its priority and position in the menu and has no effect on which label is the default.
Question 25
You need to be alerted when users share sensitive documents from Microsoft OneDrive to any users outside your company.
What should you do?
Show answer and explanation
Correct answer: D. From the Microsoft Defender portal, create a file policy.
A file policy in Microsoft Defender for Cloud Apps, created from the Microsoft Defender portal, scans files in connected apps such as OneDrive and can filter on both content and sharing level. Combining a content inspection condition for sensitive information with an access level of external or public raises an alert whenever a sensitive document is shared with users outside the organization. File policies are designed for this kind of data protection scenario, including alerts about files shared with external domains.
Why the other options are wrong
- A. An activity policy monitors user actions and activity rates but does not inspect file content to determine whether a shared document is sensitive.
- B. An eDiscovery search finds content for legal investigations and does not raise alerts when files are shared.
- C. A DLP policy created for Exchange covers email messages, not documents shared from OneDrive.
Question 26
You have a Microsoft 365 E5 tenant that contains a user named User1. User1 is assigned the Compliance Administrator role.
User1 cannot view the regular expression in the IP Address sensitive info type.
You need to ensure that User1 can view the regular expression.
What should you do?
Show answer and explanation
Correct answer: C. Create a copy of the IP Address sensitive info type and instruct User1 to edit the copy.
IP Address is a built-in sensitive info type provided by Microsoft, and the portal does not expose or allow changes to the patterns of built-in types for any role. To work with the regular expression, an administrator copies the built-in type. The copy becomes a custom sensitive info type whose patterns, including the regular expression, can be opened and edited. Creating a copy of the IP Address type and having User1 open it for editing is therefore the way to let User1 see the regular expression.
Why the other options are wrong
- A. Global Reader grants read access to settings but does not reveal the patterns inside a built-in sensitive info type.
- B. The Reviewer role group is for reviewing eDiscovery and similar content and does not expose sensitive info type definitions.
- D. The Test function shows whether sample content matches the type but does not display the regular expression.
Question 27
You have a Microsoft 365 E5 subscription.
You need to ensure that any message or document containing a credit card number is deleted automatically 12 months after it was created. The solution must minimize administrative effort.
Which two components should you create? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: C, D. an auto-labeling policy for a retention label; a retention label
Deleting content after a fixed period is a retention action, so a retention label is created with a 12-month period based on when the item was created and an action to delete the item at the end of that period. To avoid relying on users, an auto-apply policy for that retention label is created with the condition that content contains the built-in Credit Card Number sensitive information type. The policy labels every matching message and document, and the label then deletes them automatically after 12 months.
Why the other options are wrong
- A. An auto-labeling policy for a sensitivity label classifies and protects content and cannot delete it after a retention period.
- B. A sensitivity label controls encryption and markings and has no retention or deletion settings.
- E. Credit Card Number is already a built-in sensitive information type, so creating a new one only adds effort.
Question 28
You have a Microsoft 365 E5 subscription.
You deploy Microsoft Purview Data Security Posture Management for AI (DSPM for AI).
You need to edit the default policies created as part of the deployment.
Which two Microsoft Purview solutions should you use? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, G. Insider Risk Management; Data Loss Prevention
When DSPM for AI is deployed, its default data discovery policies are created in other Microsoft Purview solutions. One is a Data Loss Prevention policy that detects sensitive information added to AI sites, and others are Insider Risk Management policies that detect visits to AI sites and risky AI usage; the remaining defaults are collection policies and a Communication Compliance policy, none of which is in the listed options. DSPM for AI lists these policies, but each one is edited in the solution that owns it, so you use Insider Risk Management for the risk policies and Data Loss Prevention for the DLP policy.
Why the other options are wrong
- B. Information Protection manages sensitivity labels and label policies, while the default DSPM for AI policies that detect AI activity are created in Data Loss Prevention and Insider Risk Management and are edited there.
- C. Compliance Manager tracks assessments and improvement actions and does not hold DSPM for AI policies.
- D. DSPM for AI displays the policies it created, but they are edited in their owning solutions.
- E. Information Barriers restricts communication between segments and has no DSPM for AI default policies.
- F. Data Lifecycle Management handles retention, and no default DSPM for AI policy is a retention policy.
Question 29
You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. Site1 contains a file named File1.
You have a retention policy named Retention1 that has the following settings:
• Retain items for a specific period
◦ Retention period: 5 years
◦ At the end of the retention period: Delete items automatically
Retention1 is applied to Site1.
You need to ensure that File1 is deleted automatically after seven years. The solution must NOT affect the retention of other files on Site1.
What should you do first?
Show answer and explanation
Correct answer: A. Publish and apply a new retention label.
Retention1 applies to the whole site, so any change to that policy would affect every file on Site1. A retention label works at the item level, so a label configured to retain for seven years and then delete automatically can be published and applied to File1 alone. Under the principles of retention, the longest retention period wins, so File1 is kept for seven years, and an explicit deletion from a retention label takes precedence over the deletion from a policy. File1 is then deleted after seven years while all other files keep the five-year behavior of Retention1.
Why the other options are wrong
- B. Access control list entries control who can open a file and have no effect on retention or deletion.
- C. A new retention policy applies to whole locations, so it would affect other files on Site1.
- D. Retention policy locations are entire sites, so a folder cannot be excluded from Retention1.
Question 30
You receive an email that contains a list of words that will be used for a sensitive information type.
You need to create a file that can be used as the source of a keyword dictionary.
In which format should you save the list?
Show answer and explanation
Correct answer: C. a CSV file that contains words separated by commas
A keyword dictionary for a sensitive info type can be created by uploading a file of terms, and the portal accepts dictionary files in TXT or CSV format. Saving the list as a CSV file with the words separated by commas produces a file that can be uploaded directly as the dictionary, after which the dictionary is used as an element of the sensitive info type.
Why the other options are wrong
- A. A JSON file is not an accepted format for uploading a keyword dictionary.
- B. A Word DOCX file is not accepted, because the dictionary upload takes plain TXT or CSV files.
- D. An Access ACCDB database is not accepted as a keyword dictionary file.
Question 31
You are creating a custom trainable classifier to identify organizational product codes referenced in Microsoft 365 content.
You identify 300 files to use as seed content.
Where should you store the seed content?
Show answer and explanation
Correct answer: C. a Microsoft SharePoint Online folder
When a custom trainable classifier is created, the positive seed content must be placed in a SharePoint Online folder that holds only those examples, and the negative examples are placed in a separate SharePoint Online folder. The classifier wizard points to that SharePoint site and folder, processes the items, and builds a prediction model from them. Storing the 300 files with product code references in a dedicated SharePoint Online folder is therefore required before the classifier can be created.
Why the other options are wrong
- A. An Azure file share is not a location the trainable classifier wizard can read seed content from.
- B. The classifier wizard asks for a SharePoint Online site and folder, so a OneDrive folder is not used for seed content.
- D. Seed content is read from a SharePoint Online folder, so a shared mailbox in Exchange Online is not a valid location.
Question 32
You are planning a data loss prevention (DLP) solution that will apply to Windows Client computers.
You need to ensure that when users attempt to copy a file that contains sensitive information to a USB storage device, the following requirements are met:
If the users are members of a group named Group1, the users must be allowed to copy the file, and an event must be recorded in the audit log.
All other users must be blocked from copying the file.
What should you create?
Show answer and explanation
Correct answer: C. two DLP policies that each contains one DLP rule
For Endpoint DLP, the users and groups that a policy applies to are chosen in the policy scope, and device rules cannot target different groups within one policy. Two different outcomes are needed for the same USB copy activity, so two policies are required. One policy is scoped to Group1 and contains a rule that sets Copy to a USB removable media to Audit only, which allows the copy and records the event. The other policy is scoped to all users with Group1 excluded and contains a rule that blocks the copy.
Why the other options are wrong
- A. A single rule applies one action to everyone in scope, so it cannot both allow and block the same activity.
- B. Rules in one Endpoint DLP policy share the same user scope and cannot target Group1 separately from other users.
Question 33
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps.
You need to ensure that you receive an alert when a user uploads a document to a third-party cloud storage service.
What should you use?
Show answer and explanation
Correct answer: D. an activity policy
Activity policies in Microsoft Defender for Cloud Apps monitor specific activities that users perform in cloud apps and raise alerts when those activities occur. Uploading a document is an activity, so an activity policy that filters on the upload file activity in cloud storage apps generates an alert each time a user uploads a document to a third-party cloud storage service. The requirement concerns the act of uploading rather than the content or sharing state of files that are already stored, which makes an activity policy the right choice.
Why the other options are wrong
- A. Insider risk policies belong to Insider Risk Management in Microsoft Purview and are not configured in Defender for Cloud Apps to alert on a single upload.
- B. A file policy scans files stored in connected apps for content and sharing settings rather than alerting on the upload activity.
- C. A sensitivity label classifies and protects content and does not raise alerts.
Question 34
You have a Microsoft 365 E5 subscription that uses data loss prevention (DLP) to protect sensitive information.
You have a document named Form.docx.
You plan to use PowerShell to create a document fingerprint based on Form.docx.
You need to first connect to the subscription.
Which cmdlet should you run?
Show answer and explanation
Correct answer: A. Connect-IPPSSession
Document fingerprints are created with the New-DlpFingerprint cmdlet and then turned into a sensitive information type with New-DlpSensitiveInformationType. Both cmdlets belong to Security and Compliance PowerShell, and Connect-IPPSSession is the cmdlet in the Exchange Online PowerShell module that opens a session to that endpoint. After connecting, the content of Form.docx is read into a variable as bytes and passed to New-DlpFingerprint to create the fingerprint.
Why the other options are wrong
- B. Connect-SPOService connects to the SharePoint Online admin service, which does not provide the DLP fingerprint cmdlets.
- C. Connect-ExchangeOnline connects to Exchange Online PowerShell, which does not include the Microsoft Purview DLP fingerprint cmdlets.
- D. Connect-MgGraph connects to Microsoft Graph PowerShell, which does not provide the DLP fingerprint cmdlets.
Question 35
You plan to implement Microsoft Purview Advanced Message Encryption.
You need to ensure that encrypted email sent to external recipients expires after seven days.
What should you create first?
Show answer and explanation
Correct answer: C. a custom branding template
Message expiration in Microsoft Purview Advanced Message Encryption is a property of a custom branding template. The template is created with New-OMEConfiguration in Exchange Online PowerShell, and the ExternalMailExpiryInDays setting defines how many days external recipients can open the encrypted message, here seven. Only after the template exists can a mail flow rule apply it to outgoing mail to external recipients, so the custom branding template is created first.
Why the other options are wrong
- A. A mail flow rule applies a branding template that must already exist, so it comes after the template is created.
- B. Message encryption uses the Microsoft Purview encryption service and needs no X.509 certificate for expiration.
- D. A remote domain controls message formatting and automatic replies for external domains and has no expiration setting.
- E. A connector controls mail routing and TLS between organizations and does not set when encrypted mail expires.
Question 36
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a Microsoft 365 tenant and 500 computers that run Windows 11. The computers are onboarded to Microsoft Purview.
You discover that a third-party application named Tailspin_scanner.exe accessed protected sensitive information on multiple computers.
Tailspin_scanner.exe is installed locally on the computers.
You need to block Tailspin_scanner.exe from accessing sensitive documents without preventing the application from accessing other documents.
Solution: From Microsoft Defender for Cloud Apps, you create an app discovery policy.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
An app discovery policy in Microsoft Defender for Cloud Apps raises alerts about cloud apps found through Cloud Discovery, such as a new app or unusual usage of an app. It works on cloud app traffic and has no control over which local files a locally installed program can open. To block Tailspin_scanner.exe only for sensitive files, the app is added to the restricted apps list in the Endpoint DLP settings, and a DLP policy for devices blocks the Access by restricted apps activity.
Why the other options are wrong
- A. An app discovery policy only alerts on discovered cloud apps and cannot block a local executable from opening sensitive files.
Question 37
You have a Microsoft 365 E5 subscription.
You need to prevent users from uploading data loss prevention (DLP)-protected documents to the following third-party websites:
• web1.contoso.com
• web2.contoso.com
The solution must minimize administrative effort.
To what should you set the Service domains setting for Endpoint DLP?
Show answer and explanation
Correct answer: C. web1.contoso.com and web2.contoso.com
The Service domains setting in Endpoint DLP takes each entry in FQDN format, and the only wildcard form is a leading *. that covers a domain together with all of its subdomains. Adding web1.contoso.com and web2.contoso.com to the list with the list set to Block restricts uploads of protected files to exactly those two third-party sites. Two entries are quick to add, and no later work is needed to exempt other contoso.com sites that a broader entry would catch, so this meets the goal with the least administrative effort.
Why the other options are wrong
- A. The entry *.contoso.com restricts uploads to every contoso.com subdomain, which goes beyond the two sites and creates extra work to exempt the others.
- B. The entry contoso.com identifies only that host name and does not cover the subdomains web1.contoso.com and web2.contoso.com.
- D. A partial wildcard such as web*.contoso.com is not a supported format, because the only wildcard allowed is a leading *. in front of a domain.
Question 38
Your company has a Microsoft 365 tenant.
The company performs annual employee assessments. The assessment results are recorded in a document named AssessmentTemplate.docx that is created by using a Microsoft Word template. Copies of the employee assessments are sent to employees and their managers.
The assessment copies are stored in mailboxes, Microsoft SharePoint Online sites, and OneDrive folders. A copy of each assessment is also stored in a SharePoint Online folder named Assessments.
You need to create a data loss prevention (DLP) policy that prevents the employee assessments from being emailed to external users. You will use a document fingerprint to identify the assessment documents. The solution must minimize effort.
What should you include in the solution?
Show answer and explanation
Correct answer: A. Create a fingerprint of AssessmentTemplate.docx.
Document fingerprinting is designed for standard forms and templates. It converts a blank form or template into a sensitive information type that detects documents based on the same form, so every completed assessment created from the Word template is recognized. Creating one fingerprint from AssessmentTemplate.docx and using it as a condition in a DLP policy that blocks sharing with external recipients meets the goal with the least effort, because no sample collection or data upload is needed.
Why the other options are wrong
- B. Exact Data Match detects values from a structured table of sensitive records, not documents built from a common template.
- C. Sample documents in a seed folder are used to train a trainable classifier, not to create a document fingerprint.
- D. A document fingerprint is created from the form itself, so fingerprinting 100 completed assessments adds effort with no benefit.
Question 39
You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1.
You need to implement Microsoft Purview data lifecycle management.
What should you create first?
Show answer and explanation
Correct answer: D. a retention label
Microsoft Purview Data Lifecycle Management uses retention policies and retention labels to keep content for as long as required and to delete it when it is no longer needed. Of the listed objects, the retention label is the only one that belongs to Data Lifecycle Management. It defines the retention and deletion settings that are later published to users or applied automatically through a retention label policy. Creating the retention label is therefore the first step for managing the lifecycle of content in Site1.
Why the other options are wrong
- A. A sensitivity label policy publishes labels that classify and protect content, which belongs to Information Protection.
- B. A Data Loss Prevention policy prevents oversharing of sensitive content and does not manage retention or deletion.
- C. An auto-labeling policy needs an existing label to apply, so it cannot be created first.
Question 40
You have a Microsoft 365 E5 tenant that has a retention label named Label1.
You need to create an auto-labeling policy that will apply Label1.
To which location can Label1 be applied?
Show answer and explanation
Correct answer: A. OneDrive accounts
An auto-apply policy for a retention label can target Exchange mailboxes, SharePoint classic and communication sites, OneDrive accounts, and Microsoft 365 Groups. OneDrive accounts are one of the supported locations, so Label1 can be applied automatically to documents stored in users' OneDrive accounts when they match the policy conditions.
Why the other options are wrong
- B. A Microsoft Entra security group is an identity object, not a content location where retention labels are applied.
- C. Microsoft Defender for Cloud Apps is not a location for auto-apply retention label policies.
- D. Teams chats are covered by retention policies, not by auto-applied retention labels.
Question 41
You have a Microsoft 365 subscription.
You need to ensure that users can apply retention labels to individual documents in their Microsoft SharePoint libraries.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: D, E. From the Microsoft Purview portal, publish a label; From the Microsoft Purview portal, create a label.
Making retention labels available for users to apply manually is a two-step process. First, create the retention label in the Microsoft Purview portal to define the retention settings, such as how long to keep content and what happens at the end of the period. Second, publish the label by using a retention label policy that includes the SharePoint sites location. After the policy takes effect, users can select the label for individual documents in their SharePoint libraries.
Why the other options are wrong
- A. Defender for Cloud Apps file policies govern files in cloud apps and do not make retention labels available to users.
- B. Site Settings in SharePoint do not create or publish retention labels.
- C. SharePoint records management settings do not create or publish retention labels for users.
Question 42
You have a Microsoft 365 tenant that uses Microsoft Purview Information Protection.
You create a sensitivity label named Sensitivity1 and configure Sensitivity1 to encrypt files and emails.
You publish Sensitivity1.
You discover that users are NOT prompted to apply Sensitivity1 to their files and email.
You need to ensure that the users must apply Sensitivity1 to their files and email before saving the files or sending the emails. The solution must meet the following requirements:
• Prevent users from removing the label from the files and emails.
• Minimize administrative effort.
What should you do?
Show answer and explanation
Correct answer: C. Configure the protection settings of the sensitivity label policy for Sensitivity1.
Sensitivity1 is already published, so a label policy already exists for it. Requirements such as forcing users to apply a label before saving a file or sending an email are policy settings, not label settings. Editing the existing label policy to turn on the setting that requires users to apply a label to their email and documents makes labeling mandatory. Because a label is then required, users cannot leave the content unlabeled by removing the label. Changing the existing policy meets the goal with the least administrative effort.
Why the other options are wrong
- A. Control access is an encryption setting of the label and does not force users to apply a label.
- B. An auto-labeling policy applies labels automatically and does not require users to apply Sensitivity1 themselves.
- D. Sensitivity1 is already published, so a new label policy only adds administrative effort.
Question 43
You have a Microsoft 365 tenant.
You create the following:
• A sensitivity label
• An auto-labeling policy
You need to ensure that the sensitivity label is applied to all the data discovered by the auto-labeling policy.
What should you do first?
Show answer and explanation
Correct answer: D. Run the policy in simulation mode.
After a sensitivity label and an auto-labeling policy exist, the next step is to run the policy in simulation mode. Simulation mode evaluates the content in the chosen locations and shows which items would be labeled, without changing any of them. You review the matched items, refine the conditions if needed, and then turn on the policy so that the label is applied to all the data that the policy discovers. Simulation therefore comes first, before the policy labels anything.
Why the other options are wrong
- A. Enable-TransportRule turns on an Exchange mail flow rule and has no role in an auto-labeling policy for sensitivity labels.
- B. Insider Risk Management detects risky user activity and is not a prerequisite for auto-labeling.
- C. A trainable classifier is an optional condition type and is not the first step after the policy is created.
Question 44
You receive an email that contains a list of words that will be used for a sensitive information type.
You need to create a file that can be used as the source of a keyword dictionary.
In which format should you save the list?
Show answer and explanation
Correct answer: D. a text file that has one word on each line
A keyword dictionary is built from a plain list of terms. The documented procedure is to copy the keywords into a text file and make sure that each keyword is on a separate line, and the file is then used to create the dictionary in the Microsoft Purview portal or with the New-DlpKeywordDictionary cmdlet. Saving the words from the email as a text file with one word on each line therefore produces a file that can be used directly as the dictionary content.
Why the other options are wrong
- A. An XLSX workbook is not a supported input for a keyword dictionary, which is built from a plain list of terms.
- B. XML is used for custom sensitive information type rule packages, not as the keyword list for a dictionary.
- C. An Access database file is not a supported input for a keyword dictionary.
Question 45
You have a Microsoft 365 E5 subscription.
You have a Microsoft SharePoint Online document library that contains Microsoft Word and Excel documents. The documents contain the following types of information:
• Credit card numbers
• Physical addresses in the UK
• National health service numbers from the UK
• Sensitive projects that contain the following words: Project Tailspin, Project Contoso, and Project Falcon
You have email messages in Microsoft Exchange Online that contain the following information types:
• Credit card numbers
• User sign-in credentials
• National health service numbers from the UK
You plan to use sensitive information types (SITs) for compliance policies.
What is the minimum number of SITs required to classify all the information types?
Show answer and explanation
Correct answer: B. 5
Each distinct kind of data needs one sensitive info type, and a type that appears in both SharePoint and Exchange is counted only once. Credit card numbers use the built-in Credit Card Number type, UK physical addresses use the built-in U.K. physical addresses type, and NHS numbers use the built-in U.K. National Health Service number type. User sign-in credentials use a built-in credential type. The project names Project Tailspin, Project Contoso, and Project Falcon need one custom type based on a keyword list. That totals five sensitive info types.
Why the other options are wrong
- A. Two types cannot detect five different kinds of information, since each type detects only its own pattern.
- C. Seven types counts some information twice or splits the project keywords, which a single keyword-based type already covers.
- D. Ten types counts each item separately for every location instead of reusing one type across SharePoint and Exchange.
Question 46
You are creating a data loss prevention (DLP) policy that will apply to all available locations except Fabric and Power BI workspaces.
You configure an advanced DLP rule in the policy.
Which type of condition can you use in the rule?
Show answer and explanation
Correct answer: A. Sensitive info type
The conditions offered in an advanced DLP rule depend on the locations selected for the policy, and only conditions that every selected location supports are available. When the policy covers all locations except Fabric and Power BI workspaces, the set includes Exchange, SharePoint, OneDrive, Teams chat and channel messages, devices and the remaining locations. The Content contains condition with sensitive info types is supported across all of these locations, so it can be used in the rule to detect data such as credit card numbers or national identification numbers.
Why the other options are wrong
- B. DLP rules do not offer a content search query condition, because KQL queries belong to Content search and eDiscovery.
- C. The sensitivity label condition is not available when Teams chat and channel messages is one of the selected locations.
- D. A standalone keywords condition is not available when this many locations are combined, so keywords must be detected through a sensitive info type.
Question 47
You have a Microsoft 365 tenant that is opt-in for trainable classifiers.
You need to ensure that a user named User1 can create custom trainable classifiers. The solution must use the principle of least privilege.
Which role should you assign to User1?
Show answer and explanation
Correct answer: B. Compliance Administrator
Creating custom trainable classifiers is a Microsoft Purview compliance task, and the Compliance Administrator role includes the permissions to create, train, and publish them. Compliance Administrator is limited to compliance features, so it meets the requirement without granting control over the rest of the tenant. Global Administrator could also perform the task but grants far more access than needed, and Security Operator does not include the permissions that manage classifiers.
Why the other options are wrong
- A. Security Administrator is a broad security role that spans Microsoft Defender and Microsoft Entra ID, while Compliance Administrator is the role scoped to compliance features such as trainable classifiers, which fits the principle of least privilege.
- C. Global Administrator grants full control of the tenant, which breaks the principle of least privilege.
- D. Security Operator handles alerts and security operations and cannot create trainable classifiers.
Question 48
You have a Microsoft 365 E5 tenant that has a retention label named Label1.
You need to create an auto-labeling policy that will apply Label1.
To which location can Label1 be applied?
Show answer and explanation
Correct answer: B. OneDrive accounts
An auto-apply policy for a retention label can target Exchange mailboxes, SharePoint classic and communication sites, OneDrive accounts, and Microsoft 365 Groups. OneDrive accounts are therefore a valid location, and Label1 can be applied automatically to documents stored there when they match the policy conditions.
Why the other options are wrong
- A. Teams channel messages are covered by retention policies, not by auto-applied retention labels.
- C. On-premises repositories are not a location for auto-apply retention label policies.
- D. Teams chats are covered by retention policies, not by auto-applied retention labels.
Question 49
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You recently discovered that the developers at your company emailed Azure Storage Account keys in plain text to third parties.
You need to ensure that when Azure Storage Account keys are emailed, the emails are encrypted.
Solution: You configure a mail flow rule that matches a sensitive info type.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
In Exchange Online, a mail flow rule cannot be relied on to detect sensitive information types. The New-TransportRule reference states that the MessageContainsDataClassifications parameter is functional only in on-premises Exchange, and the Exchange Online list of mail flow rule conditions no longer includes a sensitive information type condition. Detection of sensitive information in email belongs to Microsoft Purview Data Loss Prevention, so the goal is met with a DLP policy for the Exchange email location that detects the Azure Storage Account Key sensitive info type and uses the action that encrypts email messages with Microsoft Purview Message Encryption.
Why the other options are wrong
- A. The sensitive information type condition for mail flow rules works only in on-premises Exchange, so in Exchange Online this rule cannot be relied on to detect the keys.
Question 50
You have a Microsoft 365 E5 subscription that contains a Microsoft Teams channel named Channel1. Channel1 contains research and development documents.
You plan to implement Microsoft 365 Copilot for the subscription.
You need to prevent the contents of files stored in Channel1 from being included in answers generated by Copilot and shown to unauthorized users.
What should you use?
Show answer and explanation
Correct answer: A. sensitivity labels
Microsoft 365 Copilot honors the usage rights granted by sensitivity labels that apply encryption. When the research and development files in Channel1 are labeled with a sensitivity label that grants access only to authorized users, Copilot can use the content only for users who hold the required rights, so the contents are not summarized for anyone else. Sensitivity labels are therefore the control that keeps protected file contents out of Copilot answers shown to unauthorized users.
Why the other options are wrong
- B. A Communication Compliance policy detects inappropriate messages for review and does not control what file content Copilot can return.
- C. Insider Risk Management detects risky user activity and does not restrict Copilot access to files.
- D. Information Barriers restrict communication and collaboration between segments of users rather than protecting the contents of specific files.
Question 51
You have a Microsoft 365 subscription that contains two Microsoft SharePoint Online sites named Site1 and Site2.
You plan to use policies to meet the following requirements:
• Add a watermark of Confidential to a document if the document contains the words Project1 or Project2.
• Retain a document for seven years if the document contains credit card information.
• Add a watermark of Internal Use Only to all the documents stored on Site2.
• Add a watermark of Confidential to all the documents stored on Site1.
You need to recommend the minimum number of sensitive info types required.
How many sensitive info types should you recommend?
Show answer and explanation
Correct answer: B. 2
Only requirements that depend on the content of a document need a sensitive info type. Adding the Confidential watermark when a document contains Project1 or Project2 needs one custom sensitive info type whose keyword list contains both words. Retaining documents that contain credit card information for seven years needs the Credit Card Number sensitive info type in an auto-apply retention label policy. The watermarks for all documents on Site1 and Site2 depend only on location, so they are handled by sensitivity labels applied by location, such as a default sensitivity label for the document library, and need no sensitive info type. The minimum is two.
Why the other options are wrong
- A. One sensitive info type cannot detect both the project keywords and credit card numbers, which drive different labels and actions.
- C. A third type is unnecessary because the Site1 and Site2 watermarks depend on location, not on content.
- D. Four types would add one per requirement, but the two site-based watermarks need no content detection at all.
Question 52
You have a Microsoft 365 E5 subscription.
You plan to deploy Microsoft Purview Data Security Posture Management for AI (DSPM for AI) to protect company data that contains Personally Identifiable Information (PII) from being shared with third-party generative AI tools.
You need to complete the prerequisites for the planned deployment.
Which two Microsoft Purview solutions should you use? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, E. Data Loss Prevention; Audit
DSPM for AI depends on Audit because it reports on AI interactions from the audit log, so Microsoft Purview Audit must be turned on before the reports and insights populate. Data Loss Prevention is the solution that protects the PII: Endpoint DLP policies on onboarded devices warn or block users when they paste or upload sensitive information to third-party generative AI sites, and DSPM for AI uses these policies to apply the protection. Together, Audit provides the visibility and Data Loss Prevention provides the enforcement needed for this deployment.
Why the other options are wrong
- B. Information Barriers restrict communication between groups of users and play no part in protecting PII sent to AI sites.
- C. Insider Risk Management can surface risky AI usage but does not block PII from being shared and is not required for this deployment.
- D. Communication Compliance reviews messages for policy violations and does not prevent PII from reaching third-party AI tools.
Question 53
You have a Microsoft 365 tenant.
You have a database that stores customer details. Each customer has a unique 13-digit identifier that consists of a fixed pattern of numbers and letters.
You need to implement a data loss prevention (DLP) solution that meets the following requirements:
Email messages that contain a single customer identifier can be sent outside your company.
Email messages that contain two or more customer identifiers must be approved by the company's data privacy team.
Which two components should you include in the solution? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, C. a sensitive information type; a DLP policy
A custom sensitive information type defines the 13-character pattern of numbers and letters so that Microsoft Purview can detect customer identifiers in email. A DLP policy for Exchange then uses that sensitive information type with instance counts. A rule for one identifier allows the message to be sent, and a rule for two or more identifiers routes the message to the data privacy team for approval before it can leave the organization. Together they provide both detection and enforcement.
Why the other options are wrong
- A. A sensitivity label classifies and protects content and cannot count identifier instances in outgoing email.
- D. A retention label controls how long content is kept and does not control whether email can be sent.
- E. A mail flow rule is not needed because the DLP policy itself evaluates instance counts and enforces the approval requirement.
Question 54
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a Microsoft 365 tenant and 500 computers that run Windows 11. The computers are onboarded to Microsoft Purview.
You discover that a third-party application named Tailspin_scanner.exe accessed protected sensitive information on multiple computers.
Tailspin_scanner.exe is installed locally on the computers.
You need to block Tailspin_scanner.exe from accessing sensitive documents without preventing the application from accessing other documents.
Solution: From the Microsoft 365 Endpoint data loss prevention (Endpoint DLP) settings, you add a folder path to the file path exclusions.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
File path exclusions remove the listed paths from Endpoint DLP monitoring, alerts and policy enforcement. Files in an excluded folder are not audited, and DLP policies are not enforced on them. Adding a folder path therefore reduces protection and does nothing to stop Tailspin_scanner.exe from reading sensitive files elsewhere. To meet the goal, Tailspin_scanner.exe is added to the restricted apps list in the Endpoint DLP settings, and a DLP policy for devices blocks the Access by restricted apps activity, which affects only files that match the policy.
Why the other options are wrong
- A. Excluding a folder path removes DLP protection from that path and does not restrict Tailspin_scanner.exe at all.
Question 55
You have a Microsoft 365 E5 subscription that uses Microsoft Teams.
You plan to implement sensitivity labels.
You need to ensure that you can view and apply sensitivity labels to new Microsoft Teams sites.
What should you do first?
Show answer and explanation
Correct answer: C. Configure the EnableMIPLabels setting in Microsoft Entra ID.
Sensitivity labels for Microsoft 365 groups, Teams, and SharePoint sites (container labels) are available only after support is turned on in Microsoft Entra ID by setting EnableMIPLabels to True in the group settings. Until that setting is enabled, the Groups & sites scope cannot be used and no label appears when users create a team. After it is enabled, you synchronize the labels, create or update labels scoped to Groups & sites, and publish them, so configuring EnableMIPLabels is the first step.
Why the other options are wrong
- A. Set-SPOSite applies a label to an existing SharePoint site and depends on container labeling already being enabled.
- B. A Groups & sites label cannot be applied to teams until EnableMIPLabels is turned on in Microsoft Entra ID.
- D. Execute-AzureAdLabelSync synchronizes labels to Microsoft Entra ID, which is a later step after container support is enabled.
Question 56
You have a Microsoft 365 subscription.
You create a new trainable classifier.
You need to train the classifier.
Which source can you use to train the classifier?
Show answer and explanation
Correct answer: C. a Microsoft SharePoint Online site
A custom trainable classifier is trained with seed content, which consists of positive and negative sample items placed in separate, dedicated SharePoint Online folders. When you create the classifier, you point it at those SharePoint Online folders, and Microsoft Purview processes the samples to build the prediction model before you test it. The training source must be in SharePoint Online, so a Microsoft SharePoint Online site is the source you can use.
Why the other options are wrong
- A. An on-premises SharePoint Server site cannot be selected as the seed content location for a trainable classifier.
- B. An Azure Files share is not a supported location for classifier seed content.
- D. An NFS file share cannot be used to provide seed content for a trainable classifier.
That was 56 of 280.
The full Microsoft SC-401 pack has all 280 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 62 free as one PDF by email. Get the Half Pack →