Microsoft SC-401: Administering Information Security in Microsoft 365

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Implement information protection

   A company wants users in one department to see a standard sensitivity label on new documents by default. Which configuration should the administrator create?

   1. AA label policy that publishes the label to that department's users with it set as the default label
   2. BA label scoped to the Global Administrator role so that the role alone can view it
   3. CA retention label applied to Exchange mailboxes, with a seven-year retention period
   4. DA DLP rule that blocks documents from being shared by users in the Marketing department while the policy is in effect
   Show answer and explanationHide answer

   Correct answer: A

   A label policy publishes labels to selected users and can set a default label for them. Admin-only visibility, retention labels, and blocking rules do not assign a default sensitivity label to a user group's documents.

2. Question 2Implement data loss prevention

   A DLP policy must detect credit card numbers in outgoing email and block the message when they are sent externally. Which component does the detection?

   1. AA retention policy for Exchange mailboxes that deletes messages after a fixed period in the tenant
   2. BA sensitivity label with no auto-labeling conditions that is applied manually to each document
   3. CAn audit log search query that filters Exchange events by user, operation, and date range for review
   4. DA sensitive information type that matches card number patterns, used in the DLP rule
   Show answer and explanationHide answer

   Correct answer: D

   Sensitive information types detect patterns such as card numbers, and the DLP rule takes action on matches. Labels classify content, retention governs lifecycle, and audit searches investigate activity.

3. Question 3Manage search and investigations

   Legal requires that all mailbox content related to a case be preserved, even if users delete it. Which feature achieves this?

   1. AAn eDiscovery hold on the relevant mailboxes and sites
   2. BTurning off mailbox auditing for the relevant mailbox users
   3. CExporting the mailbox to a USB drive once as a PST file
   4. DAsking users to keep their Deleted Items folder open in Outlook
   Show answer and explanationHide answer

   Correct answer: A

   An eDiscovery hold preserves content in the specified locations even when users delete it. Asking users to keep folders open, one-time exports, and turning off auditing do not preserve content reliably.

4. Question 4Manage insider and privacy risk

   An insider risk policy must detect when a departing employee downloads large volumes of confidential files. Which activity does the policy use to identify this?

   1. AThe employee's birthdate attribute as stored in the Microsoft Entra ID user profile
   2. BThe dominant color of the employee's profile photo as uploaded to Microsoft 365 by the user
   3. CThe number of Microsoft Teams meetings the employee attends each week during business hours
   4. DRisk indicators from file activity signals, such as bulk downloads before departure
   Show answer and explanationHide answer

   Correct answer: D

   Insider risk policies use indicators from activity signals such as bulk downloads, combined with HR or departure context. Profile photos, meeting counts, and birthdays are not valid risk indicators.

5. Question 5Implement records management and retention

   A regulation requires that certain contracts be kept for seven years and then deleted. Which configuration best meets this requirement?

   1. AA retention policy that keeps contract content indefinitely by retaining items with no end date
   2. BA sensitivity label that marks contracts as Public, which classifies them
   3. CA calendar reminder email sent to the legal team each year so that staff can review contracts
   4. DA retention label with a seven-year period and deletion at the end of the period
   Show answer and explanationHide answer

   Correct answer: D

   A retention label with a defined period and a disposition action enforces both the keep and delete requirements automatically. Keeping everything forever violates the deletion rule, public labels do not manage retention, and reminders are manual.