SC-401 sample exam questions

Sensitivity labels support for SharePoint and OneDrive is turned on in the Microsoft Purview portal, under Information Protection label settings (Enable sensitivity labels for Office files in SharePoint and OneDrive). The other admin centers do not host this setting.

In a regular expression, [0-9] is a character class that matches any single digit, and the quantifier {6} repeats it exactly six times. So pjt[0-9]{6}sct matches values such as pjt123456sct.

Label1 uses Double Key Encryption. Content protected with DKE is not accessible to Microsoft 365 Copilot, because Microsoft cannot decrypt it, so Copilot cannot summarize the file for any user regardless of Co-Author, Review or Viewer permissions.

Copilot can summarize encrypted content only for users who have both the VIEW and EXTRACT usage rights. Co-Owner and Co-Author include EXTRACT, while Reviewer and Viewer do not. Any user with VIEW rights can still get a link to the file from Copilot.

With opt-in tenants, Compliance Administrator is the least privileged listed role that can create and manage custom trainable classifiers. Global Administrator is excessive, and Security Administrator and Security Operator lack the needed compliance permissions.

Sensitivity labels apply natively to modern Office formats such as .docx and .xlsx. The legacy .doc format and plain .txt files are not supported by built-in labeling in the Office apps, so only File2 and File3 can have Label1 applied.

The Teams chat and channel messages location covers message text only. Files shared in Teams chats are stored in the sender's OneDrive account, so a DLP policy must include the OneDrive accounts location to protect documents shared in chats. Channel files would sit in SharePoint.

JIT protection applies only to in-scope users on onboarded devices and holds egress actions on files not yet evaluated. User1 and File1 qualify, so the copy is blocked. User2 is out of scope and File2 is already evaluated, and Device3 is not onboarded, so JIT does nothing there.

Security & Compliance PowerShell's Set-RetentionCompliancePolicy with -RetryDistribution redistributes a policy whose deployment failed, which clears the Off (Error) status. Set-RetentionPolicy targets Exchange MRM policies, and the other cmdlets and parameters do not redeploy retention label policies.

An audit retention policy can include multiple record types, but activity filtering applies to the whole policy. Copilot and DLP endpoint records, with all activities, go in one policy, while the two selected Entra password activities need their own policy. That makes two policies.

A DLP policy for OneDrive with a condition that content is shared with people outside the organization and an alert action creates the notification admins need. Identity Protection, eDiscovery and data investigations do not alert in real time on sharing of sensitive documents.

Set-AuditConfig -Workload Exchange is not a valid way to enable mailbox sign-in auditing. Mailbox audit logging is enabled per mailbox with Set-Mailbox -AuditEnabled, so this solution does not meet the goal.

Insider risk management notice templates are created under the solution's Notice templates tab in the Microsoft Purview portal. The message body accepts HTML tags for formatting, such as links, headings and bold text, so HTML is the supported format.

Detecting theft by users who resigned or are near termination uses the policy template for data theft by departing users, which relies on a HR connector supplying resignation and termination dates. Office indicators and device onboarding help detection but do not trigger the policy.

Defender for Cloud Apps file policies scan files in connected apps such as OneDrive and alert on sharing, for example with external users. Activity policies track user actions, not file sharing state, and Exchange DLP or Identity Protection do not cover OneDrive sharing.