Amazon
Anthropic
Avaya
Cisco
CompTIA
CrowdStrike
EC-Council
EXIN
Fortinet
Google
ISC
ISC2
ITIL
Juniper
Microsoft
NVIDIA
Palo Alto Networks
Salesforce
SAP
VMware
All Vendors

Microsoft Administering Information Security in 365 SC-401 Dumps in PDF

Free Microsoft SC-401 Real Questions (page: 6)

SC-401 PDF — 291 Questions

Case Study
Instructions
This is a case study. Case studies are not timed separately from other exam sections. You can use as much exam time as you would like to complete each case study. However, there might be additional case studies or other exam sections. Manage your time to ensure that you can complete all the exam sections in the time provided. Pay attention to the Exam Progress at the top of the screen so you have sufficient time to complete any exam sections that follow this case study.
To answer the case study questions, you will need to reference information that is provided in the case. Case studies and associated questions might contain exhibits or other resources that provide more information about the scenario described in the case. Information provided in an individual question does not apply to the other questions in the case study.
A Review Screen will appear at the end of this case study. From the Review Screen, you can review and change your answers before you move to the next exam section. After you leave this case study, you will NOT
be able to return to it.
To start the case study
To display the first question in this case study, select the "Next" button. To the left of the question, a menu provides links to information such as business requirements, the existing environment, and problem statements. Please read through all this information before answering any questions.
When you are ready to answer a question, select the "Question" button to return to the question.
Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and three branch offices in Seattle,
Boston, and Johannesburg.
Existing Environment
Microsoft 365 Environment
Contoso has a Microsoft 365 E5 tenant. The tenant contains the administrative user accounts shown in the following table.

Users store data in the following locations:
● SharePoint sites
● OneDrive accounts
● Exchange mailboxes
● Exchange public folders
● Teams chats
● Teams channel messages
When users in the research department create documents, they must add a 10-digit project code to each document. Project codes that start with the digits 999 are confidential.
Contoso is not using Optical character recognition (OCR) in Microsoft 365.
SharePoint Online Environment
Contoso has four Microsoft SharePoint Online sites named Site1, Site2, Site3, and Site4.
Site2 contains the files shown in the following table.

Two users named User1 and User2 are assigned roles for Site2 as shown in the following table.

Site3 stores documents related to the company's projects. The documents are organized in a folder hierarchy based on the project.
Site4 has the following two retention policies applied:
● Name: Site4RetentionPolicy1
- Locations to apply the policy: Site4
- Delete items older than: 2 years
- Delete content based on: When items were created
● Name: Site4RetentionPolicy2
- Locations to apply the policy: Site4
- Retain items for a specific period: 4 years
- Start the retention period based on: When items were created
- At the end of the retention period: Do nothing
Problem Statements
Management at Contoso is concerned about data leaks. On several occasions, confidential research department documents were leaked.
Requirements
Planned Changes
Contoso plans to create the following data loss prevention (DLP) policy:
● Name: DLPpolicy1
● Locations to apply the policy: Site2
● Conditions:
- Content contains any of these sensitive info types: SWIFT Code
- Instance count: 2 to any
● Actions: Restrict access to the content
Technical Requirements
Contoso must meet the following technical requirements:
● All administrative users must be able to review DLP reports.
● Whenever possible, the principle of least privilege must be used.
● For all users, all Microsoft 365 data must be retained for at least one year.
● Confidential documents must be detected and protected by using Microsoft 365.
● Site1 documents that include credit card numbers must be labeled automatically.
● All administrative users must be able to create Microsoft 365 sensitivity labels.
● After a project is complete, the documents in Site3 that relate to the project must be retained for 10 years.

You have a Microsoft 365 E5 subscription that contains four users named User1, User2, User3, and User4 and a file named File1.docx. File1 has a sensitivity label applied. The label is configured as shown in the following table.

Which users can summarize File1 by using Microsoft 365 Copilot?

  1. User1 only
  2. User1 and User2 only
  3. User1, User2, and User3 only
  4. User1, User2, User3, and User4

Answer(s): B

Explanation:

To summarize a file with a sensitivity label using Microsoft 365 Copilot, a user needs the EXTRACT and VIEW
usage rights, especially if the sensitivity label applies encryption, according to Microsoft Learn. These rights are necessary for Copilot to access and process the content of the file, according to Microsoft Learn. If the user doesn't have these rights, Copilot won't be able to summarize the file.
* User1 - Yes
An owner has EXTRACT and VIEW usage rights.
* User2 - Yes
A user with Editor permissions can summarize a file with a sensitivity label using Microsoft 365 Copilot, but only if the sensitivity label grants the necessary usage rights, specifically the "EXTRACT" right, to the user. If the sensitivity label restricts the "EXTRACT" right, Copilot will not be able to summarize the file.
* User3 - No
A Restricted Editor in Microsoft 365 Copilot cannot summarize a file with a sensitivity label that restricts access.
Microsoft 365 Copilot respects sensitivity labels and will not process files if the user doesn't have the necessary permissions (like EXTRACT and VIEW). If a user only has VIEW rights, Copilot will provide a reference link to the file instead of summarizing it.
* User4 - No


Reference:

https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-architecture-data-protection-auditi ng




Case Study
Instructions
This is a case study. Case studies are not timed separately from other exam sections. You can use as much exam time as you would like to complete each case study. However, there might be additional case studies or other exam sections. Manage your time to ensure that you can complete all the exam sections in the time provided. Pay attention to the Exam Progress at the top of the screen so you have sufficient time to complete any exam sections that follow this case study.
To answer the case study questions, you will need to reference information that is provided in the case. Case studies and associated questions might contain exhibits or other resources that provide more information about the scenario described in the case. Information provided in an individual question does not apply to the other questions in the case study.
A Review Screen will appear at the end of this case study. From the Review Screen, you can review and change your answers before you move to the next exam section. After you leave this case study, you will NOT
be able to return to it.
To start the case study
To display the first question in this case study, select the "Next" button. To the left of the question, a menu provides links to information such as business requirements, the existing environment, and problem statements. Please read through all this information before answering any questions.
When you are ready to answer a question, select the "Question" button to return to the question.
Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and three branch offices in Seattle,
Boston, and Johannesburg.
Existing Environment
Microsoft 365 Environment
Contoso has a Microsoft 365 E5 tenant. The tenant contains the administrative user accounts shown in the following table.

Users store data in the following locations:
● SharePoint sites
● OneDrive accounts
● Exchange mailboxes
● Exchange public folders
● Teams chats
● Teams channel messages
When users in the research department create documents, they must add a 10-digit project code to each document. Project codes that start with the digits 999 are confidential.
Contoso is not using Optical character recognition (OCR) in Microsoft 365.
SharePoint Online Environment
Contoso has four Microsoft SharePoint Online sites named Site1, Site2, Site3, and Site4.
Site2 contains the files shown in the following table.

Two users named User1 and User2 are assigned roles for Site2 as shown in the following table.

Site3 stores documents related to the company's projects. The documents are organized in a folder hierarchy based on the project.
Site4 has the following two retention policies applied:
● Name: Site4RetentionPolicy1
- Locations to apply the policy: Site4
- Delete items older than: 2 years
- Delete content based on: When items were created
● Name: Site4RetentionPolicy2
- Locations to apply the policy: Site4
- Retain items for a specific period: 4 years
- Start the retention period based on: When items were created
- At the end of the retention period: Do nothing
Problem Statements
Management at Contoso is concerned about data leaks. On several occasions, confidential research department documents were leaked.
Requirements
Planned Changes
Contoso plans to create the following data loss prevention (DLP) policy:
● Name: DLPpolicy1
● Locations to apply the policy: Site2
● Conditions:
- Content contains any of these sensitive info types: SWIFT Code
- Instance count: 2 to any
● Actions: Restrict access to the content
Technical Requirements
Contoso must meet the following technical requirements:
● All administrative users must be able to review DLP reports.
● Whenever possible, the principle of least privilege must be used.
● For all users, all Microsoft 365 data must be retained for at least one year.
● Confidential documents must be detected and protected by using Microsoft 365.
● Site1 documents that include credit card numbers must be labeled automatically.
● All administrative users must be able to create Microsoft 365 sensitivity labels.
● After a project is complete, the documents in Site3 that relate to the project must be retained for 10 years.

You have a Microsoft 365 E5 tenant that uses a domain named contoso.com.
A user named User1 sends link-based, branded emails that are encrypted by using Microsoft Purview
Advanced Message Encryption to the recipients shown in the following table.

For which recipients can User1 revoke the emails?

  1. Recipient1 only
  2. Recipient4 only
  3. Recipient1 and Recipient2 only
  4. Recipient3 and Recipient4 only
  5. Recipient1, Recipient2, Recipient3, and Recipient4

Answer(s): B


Reference:

https://docs.microsoft.com/en-us/microsoft-365/compliance/revoke-ome-encrypted-mail




Case Study
Instructions
This is a case study. Case studies are not timed separately from other exam sections. You can use as much exam time as you would like to complete each case study. However, there might be additional case studies or other exam sections. Manage your time to ensure that you can complete all the exam sections in the time provided. Pay attention to the Exam Progress at the top of the screen so you have sufficient time to complete any exam sections that follow this case study.
To answer the case study questions, you will need to reference information that is provided in the case. Case studies and associated questions might contain exhibits or other resources that provide more information about the scenario described in the case. Information provided in an individual question does not apply to the other questions in the case study.
A Review Screen will appear at the end of this case study. From the Review Screen, you can review and change your answers before you move to the next exam section. After you leave this case study, you will NOT
be able to return to it.
To start the case study
To display the first question in this case study, select the "Next" button. To the left of the question, a menu provides links to information such as business requirements, the existing environment, and problem statements. Please read through all this information before answering any questions.
When you are ready to answer a question, select the "Question" button to return to the question.
Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and three branch offices in Seattle,
Boston, and Johannesburg.
Existing Environment
Microsoft 365 Environment
Contoso has a Microsoft 365 E5 tenant. The tenant contains the administrative user accounts shown in the following table.

Users store data in the following locations:
● SharePoint sites
● OneDrive accounts
● Exchange mailboxes
● Exchange public folders
● Teams chats
● Teams channel messages
When users in the research department create documents, they must add a 10-digit project code to each document. Project codes that start with the digits 999 are confidential.
Contoso is not using Optical character recognition (OCR) in Microsoft 365.
SharePoint Online Environment
Contoso has four Microsoft SharePoint Online sites named Site1, Site2, Site3, and Site4.
Site2 contains the files shown in the following table.

Two users named User1 and User2 are assigned roles for Site2 as shown in the following table.

Site3 stores documents related to the company's projects. The documents are organized in a folder hierarchy based on the project.
Site4 has the following two retention policies applied:
● Name: Site4RetentionPolicy1
- Locations to apply the policy: Site4
- Delete items older than: 2 years
- Delete content based on: When items were created
● Name: Site4RetentionPolicy2
- Locations to apply the policy: Site4
- Retain items for a specific period: 4 years
- Start the retention period based on: When items were created
- At the end of the retention period: Do nothing
Problem Statements
Management at Contoso is concerned about data leaks. On several occasions, confidential research department documents were leaked.
Requirements
Planned Changes
Contoso plans to create the following data loss prevention (DLP) policy:
● Name: DLPpolicy1
● Locations to apply the policy: Site2
● Conditions:
- Content contains any of these sensitive info types: SWIFT Code
- Instance count: 2 to any
● Actions: Restrict access to the content
Technical Requirements
Contoso must meet the following technical requirements:
● All administrative users must be able to review DLP reports.
● Whenever possible, the principle of least privilege must be used.
● For all users, all Microsoft 365 data must be retained for at least one year.
● Confidential documents must be detected and protected by using Microsoft 365.
● Site1 documents that include credit card numbers must be labeled automatically.
● All administrative users must be able to create Microsoft 365 sensitivity labels.
● After a project is complete, the documents in Site3 that relate to the project must be retained for 10 years.

You have a Microsoft 365 E5 subscription.
You need to ensure that encrypted email messages sent to an external recipient can be revoked or will expire within seven days.
What should you configure first?

  1. a custom branding template
  2. a mail flow rule
  3. a sensitivity label
  4. a Conditional Access policy

Answer(s): C

Explanation:

To ensure that encrypted email messages sent to external recipients can be revoked or expire within seven days, you need to configure a sensitivity label with encryption settings in Microsoft Purview Information
Protection. A sensitivity label allows you to encrypt emails and documents, set expiration policies (e.g., emails expire after 7 days), and enable email revocation
How to configure it?
● Go to Microsoft Purview compliance portal → Information Protection
● Create a sensitivity label
● Enable encryption and configure the content expiration policy
● Publish the label to users




Case Study
Instructions
This is a case study. Case studies are not timed separately from other exam sections. You can use as much exam time as you would like to complete each case study. However, there might be additional case studies or other exam sections. Manage your time to ensure that you can complete all the exam sections in the time provided. Pay attention to the Exam Progress at the top of the screen so you have sufficient time to complete any exam sections that follow this case study.
To answer the case study questions, you will need to reference information that is provided in the case. Case studies and associated questions might contain exhibits or other resources that provide more information about the scenario described in the case. Information provided in an individual question does not apply to the other questions in the case study.
A Review Screen will appear at the end of this case study. From the Review Screen, you can review and change your answers before you move to the next exam section. After you leave this case study, you will NOT
be able to return to it.
To start the case study
To display the first question in this case study, select the "Next" button. To the left of the question, a menu provides links to information such as business requirements, the existing environment, and problem statements. Please read through all this information before answering any questions.
When you are ready to answer a question, select the "Question" button to return to the question.
Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and three branch offices in Seattle,
Boston, and Johannesburg.
Existing Environment
Microsoft 365 Environment
Contoso has a Microsoft 365 E5 tenant. The tenant contains the administrative user accounts shown in the following table.

Users store data in the following locations:
● SharePoint sites
● OneDrive accounts
● Exchange mailboxes
● Exchange public folders
● Teams chats
● Teams channel messages
When users in the research department create documents, they must add a 10-digit project code to each document. Project codes that start with the digits 999 are confidential.
Contoso is not using Optical character recognition (OCR) in Microsoft 365.
SharePoint Online Environment
Contoso has four Microsoft SharePoint Online sites named Site1, Site2, Site3, and Site4.
Site2 contains the files shown in the following table.

Two users named User1 and User2 are assigned roles for Site2 as shown in the following table.

Site3 stores documents related to the company's projects. The documents are organized in a folder hierarchy based on the project.
Site4 has the following two retention policies applied:
● Name: Site4RetentionPolicy1
- Locations to apply the policy: Site4
- Delete items older than: 2 years
- Delete content based on: When items were created
● Name: Site4RetentionPolicy2
- Locations to apply the policy: Site4
- Retain items for a specific period: 4 years
- Start the retention period based on: When items were created
- At the end of the retention period: Do nothing
Problem Statements
Management at Contoso is concerned about data leaks. On several occasions, confidential research department documents were leaked.
Requirements
Planned Changes
Contoso plans to create the following data loss prevention (DLP) policy:
● Name: DLPpolicy1
● Locations to apply the policy: Site2
● Conditions:
- Content contains any of these sensitive info types: SWIFT Code
- Instance count: 2 to any
● Actions: Restrict access to the content
Technical Requirements
Contoso must meet the following technical requirements:
● All administrative users must be able to review DLP reports.
● Whenever possible, the principle of least privilege must be used.
● For all users, all Microsoft 365 data must be retained for at least one year.
● Confidential documents must be detected and protected by using Microsoft 365.
● Site1 documents that include credit card numbers must be labeled automatically.
● All administrative users must be able to create Microsoft 365 sensitivity labels.
● After a project is complete, the documents in Site3 that relate to the project must be retained for 10 years.

You have a Microsoft 365 E5 subscription that uses Microsoft Teams.
You plan to implement sensitivity labels.
You need to ensure that you can view and apply sensitivity labels to new Microsoft Teams sites.
What should you do first?

  1. Run the Set-SPOSite cmdlet.
  2. Create a new sensitivity label scoped to Groups & sites.
  3. Configure the EnableMIPLabels setting in Microsoft Entra ID.
  4. Run the Execute-AzureAdLabelSync cmdlet.

Answer(s): C




Case Study
Instructions
This is a case study. Case studies are not timed separately from other exam sections. You can use as much exam time as you would like to complete each case study. However, there might be additional case studies or other exam sections. Manage your time to ensure that you can complete all the exam sections in the time provided. Pay attention to the Exam Progress at the top of the screen so you have sufficient time to complete any exam sections that follow this case study.
To answer the case study questions, you will need to reference information that is provided in the case. Case studies and associated questions might contain exhibits or other resources that provide more information about the scenario described in the case. Information provided in an individual question does not apply to the other questions in the case study.
A Review Screen will appear at the end of this case study. From the Review Screen, you can review and change your answers before you move to the next exam section. After you leave this case study, you will NOT
be able to return to it.
To start the case study
To display the first question in this case study, select the "Next" button. To the left of the question, a menu provides links to information such as business requirements, the existing environment, and problem statements. Please read through all this information before answering any questions.
When you are ready to answer a question, select the "Question" button to return to the question.
Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and three branch offices in Seattle,
Boston, and Johannesburg.
Existing Environment
Microsoft 365 Environment
Contoso has a Microsoft 365 E5 tenant. The tenant contains the administrative user accounts shown in the following table.

Users store data in the following locations:
● SharePoint sites
● OneDrive accounts
● Exchange mailboxes
● Exchange public folders
● Teams chats
● Teams channel messages
When users in the research department create documents, they must add a 10-digit project code to each document. Project codes that start with the digits 999 are confidential.
Contoso is not using Optical character recognition (OCR) in Microsoft 365.
SharePoint Online Environment
Contoso has four Microsoft SharePoint Online sites named Site1, Site2, Site3, and Site4.
Site2 contains the files shown in the following table.

Two users named User1 and User2 are assigned roles for Site2 as shown in the following table.

Site3 stores documents related to the company's projects. The documents are organized in a folder hierarchy based on the project.
Site4 has the following two retention policies applied:
● Name: Site4RetentionPolicy1
- Locations to apply the policy: Site4
- Delete items older than: 2 years
- Delete content based on: When items were created
● Name: Site4RetentionPolicy2
- Locations to apply the policy: Site4
- Retain items for a specific period: 4 years
- Start the retention period based on: When items were created
- At the end of the retention period: Do nothing
Problem Statements
Management at Contoso is concerned about data leaks. On several occasions, confidential research department documents were leaked.
Requirements
Planned Changes
Contoso plans to create the following data loss prevention (DLP) policy:
● Name: DLPpolicy1
● Locations to apply the policy: Site2
● Conditions:
- Content contains any of these sensitive info types: SWIFT Code
- Instance count: 2 to any
● Actions: Restrict access to the content
Technical Requirements
Contoso must meet the following technical requirements:
● All administrative users must be able to review DLP reports.
● Whenever possible, the principle of least privilege must be used.
● For all users, all Microsoft 365 data must be retained for at least one year.
● Confidential documents must be detected and protected by using Microsoft 365.
● Site1 documents that include credit card numbers must be labeled automatically.
● All administrative users must be able to create Microsoft 365 sensitivity labels.
● After a project is complete, the documents in Site3 that relate to the project must be retained for 10 years.

HOTSPOT (Drag and Drop is not supported)
You are implementing Microsoft Purview Advanced Message Encryption for a Microsoft 365 tenant named contoso.com.
You need to meet the following requirements:
● All email to a domain named fabrikam.com must be encrypted automatically.
● Encrypted emails must expire seven days after they are sent.
What should you configure for each requirement? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: A mail flow rule in Exchange admin center
All email to a domain named fabrikam.com must be encrypted automatically.
To automatically encrypt all emails sent to a specific domain with Microsoft Purview Advanced Message
Encryption, an administrator must first configure a sensitivity label with the desired encryption settings and then create an Exchange mail flow rule (also called a transport rule) in the Microsoft Purview portal to apply that sensitivity label to messages meeting the condition of being sent to the target domain.
How it works
When a user sends an email to any address within the targeted domain, the mail flow rule will trigger. It will then automatically apply the configured sensitivity label to the message, which in turn applies the associated encryption settings before the email is sent.
Note: You can create a mail flow rule in the Exchange admin center (EAC) by navigating to the "Mail flow" >
"Rules" section, and then using a template, copying an existing rule, or starting a new rule from scratch. You can define conditions, exceptions, and actions for your rule within the rule creation wizard to control how messages are processed.
Box 2: A custom branded template in Microsoft Exchange Online PowerShell
Encrypted emails must expire seven days after they are sent.
You can use message expiration on emails that your users send to external recipients who use the OME Portal to access encrypted emails. You force recipients to use the OME portal to view and reply to encrypted emails sent by your organization by using a *custom branded template* that specifies an expiration date in
PowerShell.
Note: Create a custom branding template to force mail expiration by using PowerShell
1. Using a work or school account that has sufficient permissions in your organization, such as Compliance
Administrator, start a Windows PowerShell session and connect to Exchange Online. For instructions, see
Connect to Exchange Online PowerShell.
2. Run the New-OMEConfiguration cmdlet.
New-OMEConfiguration -Identity "Expire in 7 days" -ExternalMailExpiryInDays 7
Where:
Identity is the name of the custom template.
ExternalMailExpiryInDays identifies the number of days that recipients can keep mail before it expires. You can use any value between 1–730 days.


Reference:

https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules https://learn.microsoft.com/en-us/purview/ome-advanced-expiration




Case Study
Instructions
This is a case study. Case studies are not timed separately from other exam sections. You can use as much exam time as you would like to complete each case study. However, there might be additional case studies or other exam sections. Manage your time to ensure that you can complete all the exam sections in the time provided. Pay attention to the Exam Progress at the top of the screen so you have sufficient time to complete any exam sections that follow this case study.
To answer the case study questions, you will need to reference information that is provided in the case. Case studies and associated questions might contain exhibits or other resources that provide more information about the scenario described in the case. Information provided in an individual question does not apply to the other questions in the case study.
A Review Screen will appear at the end of this case study. From the Review Screen, you can review and change your answers before you move to the next exam section. After you leave this case study, you will NOT
be able to return to it.
To start the case study
To display the first question in this case study, select the "Next" button. To the left of the question, a menu provides links to information such as business requirements, the existing environment, and problem statements. Please read through all this information before answering any questions.
When you are ready to answer a question, select the "Question" button to return to the question.
Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and three branch offices in Seattle,
Boston, and Johannesburg.
Existing Environment
Microsoft 365 Environment
Contoso has a Microsoft 365 E5 tenant. The tenant contains the administrative user accounts shown in the following table.

Users store data in the following locations:
● SharePoint sites
● OneDrive accounts
● Exchange mailboxes
● Exchange public folders
● Teams chats
● Teams channel messages
When users in the research department create documents, they must add a 10-digit project code to each document. Project codes that start with the digits 999 are confidential.
Contoso is not using Optical character recognition (OCR) in Microsoft 365.
SharePoint Online Environment
Contoso has four Microsoft SharePoint Online sites named Site1, Site2, Site3, and Site4.
Site2 contains the files shown in the following table.

Two users named User1 and User2 are assigned roles for Site2 as shown in the following table.

Site3 stores documents related to the company's projects. The documents are organized in a folder hierarchy based on the project.
Site4 has the following two retention policies applied:
● Name: Site4RetentionPolicy1
- Locations to apply the policy: Site4
- Delete items older than: 2 years
- Delete content based on: When items were created
● Name: Site4RetentionPolicy2
- Locations to apply the policy: Site4
- Retain items for a specific period: 4 years
- Start the retention period based on: When items were created
- At the end of the retention period: Do nothing
Problem Statements
Management at Contoso is concerned about data leaks. On several occasions, confidential research department documents were leaked.
Requirements
Planned Changes
Contoso plans to create the following data loss prevention (DLP) policy:
● Name: DLPpolicy1
● Locations to apply the policy: Site2
● Conditions:
- Content contains any of these sensitive info types: SWIFT Code
- Instance count: 2 to any
● Actions: Restrict access to the content
Technical Requirements
Contoso must meet the following technical requirements:
● All administrative users must be able to review DLP reports.
● Whenever possible, the principle of least privilege must be used.
● For all users, all Microsoft 365 data must be retained for at least one year.
● Confidential documents must be detected and protected by using Microsoft 365.
● Site1 documents that include credit card numbers must be labeled automatically.
● All administrative users must be able to create Microsoft 365 sensitivity labels.
● After a project is complete, the documents in Site3 that relate to the project must be retained for 10 years.

You have a Microsoft 365 subscription that contains two Microsoft SharePoint Online sites named Site1 and
Site2.
You plan to use policies to meet the following requirements:
▪ Add a watermark of Confidential to a document if the document contains the words Project1 or Project2.
▪ Retain a document for seven years if the document contains credit card information.
▪ Add a watermark of Internal Use Only to all the documents stored on Site2.
▪ Add a watermark of Confidential to all the documents stored on Site1.
You need to recommend the minimum number of sensitive info types required.
How many sensitive info types should you recommend?

  1. 1
  2. 2
  3. 3
  4. 4

Answer(s): C

Explanation:

(1) Add a watermark of Confidential to a document if the document contains the words Project1 or Project2.
(2 - Retention) Retain a document for seven years if the document contains credit card information.
(3) Add a watermark of Internal Use Only to all the documents stored on Site2.
(1 the same can be used) Add a watermark of Confidential to all the documents stored on Site1.


Reference:

https://learn.microsoft.com/en-us/purview/sit-sensitive-information-type-learn-about




Case Study
Instructions
This is a case study. Case studies are not timed separately from other exam sections. You can use as much exam time as you would like to complete each case study. However, there might be additional case studies or other exam sections. Manage your time to ensure that you can complete all the exam sections in the time provided. Pay attention to the Exam Progress at the top of the screen so you have sufficient time to complete any exam sections that follow this case study.
To answer the case study questions, you will need to reference information that is provided in the case. Case studies and associated questions might contain exhibits or other resources that provide more information about the scenario described in the case. Information provided in an individual question does not apply to the other questions in the case study.
A Review Screen will appear at the end of this case study. From the Review Screen, you can review and change your answers before you move to the next exam section. After you leave this case study, you will NOT
be able to return to it.
To start the case study
To display the first question in this case study, select the "Next" button. To the left of the question, a menu provides links to information such as business requirements, the existing environment, and problem statements. Please read through all this information before answering any questions.
When you are ready to answer a question, select the "Question" button to return to the question.
Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and three branch offices in Seattle,
Boston, and Johannesburg.
Existing Environment
Microsoft 365 Environment
Contoso has a Microsoft 365 E5 tenant. The tenant contains the administrative user accounts shown in the following table.

Users store data in the following locations:
● SharePoint sites
● OneDrive accounts
● Exchange mailboxes
● Exchange public folders
● Teams chats
● Teams channel messages
When users in the research department create documents, they must add a 10-digit project code to each document. Project codes that start with the digits 999 are confidential.
Contoso is not using Optical character recognition (OCR) in Microsoft 365.
SharePoint Online Environment
Contoso has four Microsoft SharePoint Online sites named Site1, Site2, Site3, and Site4.
Site2 contains the files shown in the following table.

Two users named User1 and User2 are assigned roles for Site2 as shown in the following table.

Site3 stores documents related to the company's projects. The documents are organized in a folder hierarchy based on the project.
Site4 has the following two retention policies applied:
● Name: Site4RetentionPolicy1
- Locations to apply the policy: Site4
- Delete items older than: 2 years
- Delete content based on: When items were created
● Name: Site4RetentionPolicy2
- Locations to apply the policy: Site4
- Retain items for a specific period: 4 years
- Start the retention period based on: When items were created
- At the end of the retention period: Do nothing
Problem Statements
Management at Contoso is concerned about data leaks. On several occasions, confidential research department documents were leaked.
Requirements
Planned Changes
Contoso plans to create the following data loss prevention (DLP) policy:
● Name: DLPpolicy1
● Locations to apply the policy: Site2
● Conditions:
- Content contains any of these sensitive info types: SWIFT Code
- Instance count: 2 to any
● Actions: Restrict access to the content
Technical Requirements
Contoso must meet the following technical requirements:
● All administrative users must be able to review DLP reports.
● Whenever possible, the principle of least privilege must be used.
● For all users, all Microsoft 365 data must be retained for at least one year.
● Confidential documents must be detected and protected by using Microsoft 365.
● Site1 documents that include credit card numbers must be labeled automatically.
● All administrative users must be able to create Microsoft 365 sensitivity labels.
● After a project is complete, the documents in Site3 that relate to the project must be retained for 10 years.

SIMULATION
Username and password
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and select the username below.
To enter your password, place your cursor in the Enter password box and select the password below.
Microsoft 365 Username:
admin@WWLx971455.onmicrosoft.com
Microsoft 365 Password: XXXXXXXXX
If the Microsoft Edge browser or Microsoft 365 portal does not load successfully, select the Microsoft Edge browser icon from the task bar, type the URL “https://admin microsoft.com”, and press Enter.
The following information is for technical support purposes only:
Lab Instance: XXXXXXXX.
Task 2
You discover that all users can apply the Confidential – Finance label.
You need to ensure that the Confidential – Finance label is available only to the members of the Leadership group.

  1. See Explanation section for answer.

Answer(s): A

Explanation:

See explanation below.


Assign sensitivity labels to Microsoft 365 groups in Microsoft Entra ID
Microsoft Entra ID supports applying sensitivity labels published by the Microsoft Purview compliance portal to
Microsoft 365 groups. Sensitivity labels apply to groups across services like Outlook, Microsoft Teams, and
SharePoint.
Assign a label to an existing group in the Microsoft Entra admin center
Step 1: Sign in to the Microsoft Entra admin center as at least a Global Administrator.
Step 2: Select Microsoft Entra ID.
Step 3: Select Groups
Step 4: From the All groups page, select the group that you want to label.
Step 5: On the selected group's page, select Properties and select a sensitivity label from the list.
Select the Confidential - Finance label

Step 6: Select Save to save your changes.


Reference:

https://learn.microsoft.com/en-us/entra/identity/users/groups-assign-sensitivity-labels




Case Study
Instructions
This is a case study. Case studies are not timed separately from other exam sections. You can use as much exam time as you would like to complete each case study. However, there might be additional case studies or other exam sections. Manage your time to ensure that you can complete all the exam sections in the time provided. Pay attention to the Exam Progress at the top of the screen so you have sufficient time to complete any exam sections that follow this case study.
To answer the case study questions, you will need to reference information that is provided in the case. Case studies and associated questions might contain exhibits or other resources that provide more information about the scenario described in the case. Information provided in an individual question does not apply to the other questions in the case study.
A Review Screen will appear at the end of this case study. From the Review Screen, you can review and change your answers before you move to the next exam section. After you leave this case study, you will NOT
be able to return to it.
To start the case study
To display the first question in this case study, select the "Next" button. To the left of the question, a menu provides links to information such as business requirements, the existing environment, and problem statements. Please read through all this information before answering any questions.
When you are ready to answer a question, select the "Question" button to return to the question.
Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and three branch offices in Seattle,
Boston, and Johannesburg.
Existing Environment
Microsoft 365 Environment
Contoso has a Microsoft 365 E5 tenant. The tenant contains the administrative user accounts shown in the following table.

Users store data in the following locations:
● SharePoint sites
● OneDrive accounts
● Exchange mailboxes
● Exchange public folders
● Teams chats
● Teams channel messages
When users in the research department create documents, they must add a 10-digit project code to each document. Project codes that start with the digits 999 are confidential.
Contoso is not using Optical character recognition (OCR) in Microsoft 365.
SharePoint Online Environment
Contoso has four Microsoft SharePoint Online sites named Site1, Site2, Site3, and Site4.
Site2 contains the files shown in the following table.

Two users named User1 and User2 are assigned roles for Site2 as shown in the following table.

Site3 stores documents related to the company's projects. The documents are organized in a folder hierarchy based on the project.
Site4 has the following two retention policies applied:
● Name: Site4RetentionPolicy1
- Locations to apply the policy: Site4
- Delete items older than: 2 years
- Delete content based on: When items were created
● Name: Site4RetentionPolicy2
- Locations to apply the policy: Site4
- Retain items for a specific period: 4 years
- Start the retention period based on: When items were created
- At the end of the retention period: Do nothing
Problem Statements
Management at Contoso is concerned about data leaks. On several occasions, confidential research department documents were leaked.
Requirements
Planned Changes
Contoso plans to create the following data loss prevention (DLP) policy:
● Name: DLPpolicy1
● Locations to apply the policy: Site2
● Conditions:
- Content contains any of these sensitive info types: SWIFT Code
- Instance count: 2 to any
● Actions: Restrict access to the content
Technical Requirements
Contoso must meet the following technical requirements:
● All administrative users must be able to review DLP reports.
● Whenever possible, the principle of least privilege must be used.
● For all users, all Microsoft 365 data must be retained for at least one year.
● Confidential documents must be detected and protected by using Microsoft 365.
● Site1 documents that include credit card numbers must be labeled automatically.
● All administrative users must be able to create Microsoft 365 sensitivity labels.
● After a project is complete, the documents in Site3 that relate to the project must be retained for 10 years.

HOTSPOT (Drag and Drop is not supported)
You have a Microsoft 365 E5 subscription that contains the data loss prevention (DLP) policies shown in the following table.

You have a custom employee information form named Template1.docx.
You plan to create a sensitive info type named Sensitive1 that will use the document fingerprint from
Template1.docx.
What should you use to create Sensitive1, and in which DLP policies can you use Sensitive1? To answer,
select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: Microsoft Purview portal
Create Sensitive1 by using:
Document fingerprinting
Compliance portal example of a patent document matching a document fingerprint of a patent template
1. In the Microsoft Purview compliance portal, select Data classification and then choose Classifiers.
2. On the Classifiers page, choose Sensitive info types > Create Fingerprint based SIT.
3. Enter a name and description for your new SIT.
4. Upload the file you wish to use as the fingerprint template.
5. OPTIONAL: Adjust the requirements for each confidence level and then choose Next. For more information,
see Partial matching and Exact matching.
6. Review your settings > Create.
7.
When the confirmation page displays, choose Done.
Box 2: DLP1, DLP2, and DLP3
Use Sensitive1 in:
DLP can use document fingerprinting as a detection method in Exchange, SharePoint, OneDrive, Teams, and
Devices.


Reference:

https://learn.microsoft.com/en-us/purview/sit-document-fingerprinting



PDF
Viewing page 6 of 38

Share your comments for Microsoft SC-401 exam with other users:

A
Anon
4/6/2026 5:22:54 PM

Are these the same questions you have to pay for in ExamTopics?

Amsterdam, The Netherlands
AI Tutor 👋 I’m here to help!