CertArea
All Microsoft exams

Free SC-401 practice test: 30 questions with answers

30 original questions for Administering Information Security in Microsoft 365, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

SC-401 exam guide: topics, cost and format

All 30 SC-401 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Implement information protection (6 questions)

  1. Question 1

    A company wants users in one department to see a standard sensitivity label on new documents by default. Which configuration should the administrator create?

    1. AA label policy that publishes the label to that department's users with it set as the default label
    2. BA label scoped to the Global Administrator role so that the role alone can view it
    3. CA retention label applied to Exchange mailboxes, with a seven-year retention period
    4. DA DLP rule that blocks documents from being shared by users in the Marketing department while the policy is in effect
    Show answer and explanation
    Correct answer: A

    A label policy publishes labels to selected users and can set a default label for them. Admin-only visibility, retention labels, and blocking rules do not assign a default sensitivity label to a user group's documents.

  2. Question 2

    Which two statements about encrypting content with sensitivity labels are correct? (Choose two.)

    1. AEncryption removes the need for any access control in the tenant
    2. BLabels can encrypt content, but never restrict who can open it
    3. CEncrypted content can always be opened by anonymous users
    4. DEncryption applied by a label travels with the document when it is shared
    5. EOnly users granted usage rights in the label can open the encrypted content
    Show answer and explanation
    Correct answer: D, E

    Label-based encryption stays with the content and enforces the usage rights set in the label, so only authorized users can open it. Encryption does not replace access control, and it always restricts who can open the content.

  3. Question 3

    Files in SharePoint contain bank account numbers that users have not labeled. The organization wants these labeled automatically. Which feature fits?

    1. AAsking each user to label every file manually according to the sensitivity labeling guidance when saving
    2. BAuto-labeling policies that detect the sensitive information types and apply the label
    3. CRemoving every bank account number from the SharePoint site by deleting the affected files
    4. DLabeling files whose file names contain the word account in the document library title and folder path
    Show answer and explanation
    Correct answer: B

    Auto-labeling applies labels based on detected sensitive information, which scales beyond manual effort. Manual labeling is inconsistent, name-based labeling misses content, and removing data is not the requirement.

  4. Question 4

    A company wants the default label applied to a SharePoint site's new documents to be Confidential. Which configuration does this?

    1. ARenaming the SharePoint site to Confidential and updating its URL so that the site name reflects its classification
    2. BBlocking uploads to the site from unmanaged devices using a conditional access policy
    3. CStoring every file in a folder named Confidential inside a separate library for records
    4. DA default label set for the document library or site, so new files receive the label automatically
    Show answer and explanation
    Correct answer: D

    A default library label applies the label to new documents automatically. Renaming the site, blocking uploads, and folder names do not apply classification.

  5. Question 5

    Which two items does a sensitive information type typically combine to detect content accurately? (Choose two.)

    1. AThe color of the document's background
    2. BThe size of the mailbox
    3. CA pattern or regular expression for the data format
    4. DSupporting keywords or checksum validation to reduce false positives
    5. EThe name of the file's author
    Show answer and explanation
    Correct answer: C, D

    Patterns detect the data format, and keywords or checksums increase precision by confirming context or validity. Author names, background colors, and mailbox sizes do not identify sensitive content.

  6. Question 6

    When a document has more than one label that could apply, the organization wants the most restrictive label to take precedence. Which configuration handles this?

    1. ARemoving the labels from documents with conflicts and reapplying them
    2. BLabel priority ordering, so that the higher-priority label applies when conflicts occur
    3. CRandom selection between the labels by the Office client at each save time
    4. DConsistently applying the least restrictive label as the default setting
    Show answer and explanation
    Correct answer: B

    Label priority determines which label wins when multiple labels apply, so the most restrictive label can be given the highest priority. Random choice and always choosing the least restrictive contradict the policy, and removing labels abandons protection.

Implement data loss prevention (6 questions)

  1. Question 7

    A DLP policy must detect credit card numbers in outgoing email and block the message when they are sent externally. Which component does the detection?

    1. AA retention policy for Exchange mailboxes that deletes messages after a fixed period in the tenant
    2. BA sensitivity label with no auto-labeling conditions that is applied manually to each document
    3. CAn audit log search query that filters Exchange events by user, operation, and date range for review
    4. DA sensitive information type that matches card number patterns, used in the DLP rule
    Show answer and explanation
    Correct answer: D

    Sensitive information types detect patterns such as card numbers, and the DLP rule takes action on matches. Labels classify content, retention governs lifecycle, and audit searches investigate activity.

  2. Question 8

    A policy must prevent users from copying confidential files to USB drives on managed Windows devices. Which control applies?

    1. AA monthly review of USB purchase orders by the procurement team to track hardware spend
    2. BBlocking internet access on managed Windows devices using a firewall rule
    3. CEndpoint DLP rules that restrict copying sensitive files to removable media
    4. DA recurring reminder notice in the company intranet home page that asks staff to comply
    Show answer and explanation
    Correct answer: C

    Endpoint DLP can block copying labeled or sensitive files to removable media on managed devices. Blocking the internet is disproportionate, notices are advisory, and monthly purchase reviews are not preventive.

  3. Question 9

    A DLP policy is being introduced for the first time, and the team wants to see what it would have blocked without disrupting users. Which mode should be used?

    1. AFull enforcement mode on day one with no visibility into what the policy would have matched
    2. BBlocking every outbound email for the company during the pilot period, pending a review
    3. CTest mode or simulation, which reports matches without enforcing the actions
    4. DDisabling the policy in the production tenant until next year's compliance cycle begins
    Show answer and explanation
    Correct answer: C

    Simulation or test mode reports what would match without interrupting users, which tunes the policy before enforcement. Immediate enforcement risks disruption, disabling defers protection, and blocking all email is disproportionate.

  4. Question 10

    A DLP policy must warn users with a policy tip when they share a file with external recipients. Which action fits?

    1. ADeleting the email and its attachments from the sender's Sent Items folders
    2. BSilent blocking of the message with no policy tip or notification shown to the sender or recipient
    3. CA policy tip that notifies the user, with an override option that is logged
    4. DForwarding the email to the user's manager for approval before it is sent externally
    Show answer and explanation
    Correct answer: C

    A policy tip informs the user at the moment of risk, and a logged override keeps an audit trail for legitimate exceptions. Silent blocking confuses users, and deletion or forwarding to a manager is not a DLP response.

  5. Question 11

    A DLP rule must block sharing of files containing health data with external users, but still allow internal sharing. Which rule design achieves this?

    1. AA rule that blocks sharing for files with health data, whether recipients are internal colleagues or external guests, in SharePoint sites
    2. BA rule with no conditions that only logs events to the Activity explorer dashboard for review, so sharing is recorded but not prevented
    3. CA rule that applies only to files in the Recycle bin and deleted SharePoint items in OneDrive
    4. DA rule that matches the health information type with a condition for external recipients and an action to block
    Show answer and explanation
    Correct answer: D

    Combining the sensitive information condition with an external recipient condition blocks only the risky sharing. Blocking all sharing removes legitimate internal work, logging-only does not block, and deleted-file rules do not address sharing.

  6. Question 12

    Which two conditions help reduce false positives in a DLP policy for credit card numbers? (Choose two.)

    1. ADisabling policy tips so users never see the match
    2. BRequiring a minimum number of matching instances before the rule triggers
    3. CMatching any sequence of 16 digits without validation
    4. DIncluding supporting keywords near the matched number
    5. EApplying the rule to every file regardless of location
    Show answer and explanation
    Correct answer: B, D

    Minimum instance counts and nearby supporting keywords make matches more precise and reduce noise. Matching any 16-digit string is very noisy, and applying the rule everywhere or hiding tips does not improve accuracy.

Manage search and investigations (6 questions)

  1. Question 13

    Legal requires that all mailbox content related to a case be preserved, even if users delete it. Which feature achieves this?

    1. AAn eDiscovery hold on the relevant mailboxes and sites
    2. BTurning off mailbox auditing for the relevant mailbox users
    3. CExporting the mailbox to a USB drive once as a PST file
    4. DAsking users to keep their Deleted Items folder open in Outlook
    Show answer and explanation
    Correct answer: A

    An eDiscovery hold preserves content in the specified locations even when users delete it. Asking users to keep folders open, one-time exports, and turning off auditing do not preserve content reliably.

  2. Question 14

    An investigator needs to find all emails from a specific sender containing a project code during a date range. Which tool should be used?

    1. AContent search with a keyword query and date filters across the mailboxes in scope
    2. BA manual search of each mailbox by opening every message for the case
    3. CReviewing the company's printed invoices and vendor statements filed monthly
    4. DSearching the users' personal phones and tablets outside the tenant
    Show answer and explanation
    Correct answer: A

    Content search applies keyword and property filters across the scoped mailboxes efficiently. Manual per-mailbox review is slow, personal phones are out of scope, and invoices do not contain the email content.

  3. Question 15

    An audit requires that audit log entries be retained for a year. Where should the administrator verify and configure this?

    1. AThe desktop wallpaper policy in Intune that sets the background
    2. BThe audit log retention policy in the compliance portal
    3. CThe printer configuration for Universal Print
    4. DThe users' personal email settings in Outlook
    Show answer and explanation
    Correct answer: B

    Audit log retention is configured through the compliance portal's audit settings and policies. Personal email settings, printers, and wallpaper policies do not control audit retention.

  4. Question 16

    A legal team collaborates on a case, and each member should see only the cases they are assigned to. Which feature supports this?

    1. APublishing the case documents on a public SharePoint site
    2. BA shared administrator login used by the entire review team
    3. CAccess to the entire tenant for every case member, including the Compliance Admin
    4. DCase management with role-based membership for each eDiscovery case
    Show answer and explanation
    Correct answer: D

    Case-based membership gives each investigator access only to assigned cases, which protects confidentiality. Shared admin logins, tenant-wide access, and public publishing break that boundary.

  5. Question 17

    An organization uses the unified audit log to investigate who accessed a confidential site last month. Which action should the administrator take?

    1. ARestore last month's backups of the SharePoint content database to find the answer
    2. BTurn off the unified audit log for the site to prevent further searches from being recorded
    3. CSearch the unified audit log for site access events over that date range, filtered to the site
    4. DAsk each employee in the department to report in writing whether they accessed the site during that month and why
    Show answer and explanation
    Correct answer: C

    The unified audit log records access events that can be searched by date and object. Self-reports are unreliable, turning off auditing destroys future evidence, and restoring backups is unnecessary for audit searches.

  6. Question 18

    Which two items are part of an eDiscovery case? (Choose two.)

    1. AA printed binder of team photos
    2. BSearches that collect relevant content
    3. CA personal email alias
    4. DLunch menus
    5. EHolds that preserve content
    Show answer and explanation
    Correct answer: B, E

    A case organizes holds and searches so that content is preserved and collected defensibly. Printed photo binders, personal aliases, and menus are not part of a case.

Manage insider and privacy risk (6 questions)

  1. Question 19

    An insider risk policy must detect when a departing employee downloads large volumes of confidential files. Which activity does the policy use to identify this?

    1. AThe employee's birthdate attribute as stored in the Microsoft Entra ID user profile
    2. BThe dominant color of the employee's profile photo as uploaded to Microsoft 365 by the user
    3. CThe number of Microsoft Teams meetings the employee attends each week during business hours
    4. DRisk indicators from file activity signals, such as bulk downloads before departure
    Show answer and explanation
    Correct answer: D

    Insider risk policies use indicators from activity signals such as bulk downloads, combined with HR or departure context. Profile photos, meeting counts, and birthdays are not valid risk indicators.

  2. Question 20

    Communication compliance must detect messages that contain harassing language within the company's chat tools. Which policy type is designed for this?

    1. AA communication compliance policy that uses classifiers for harassment and reviews flagged messages
    2. BA mailbox forwarding rule that copies inbound messages automatically to an external address
    3. CA DLP policy scoped to file attachments in SharePoint and OneDrive that does not inspect the body or subject of email messages
    4. DA retention policy that deletes chat messages automatically from Teams channels and one-to-one chats after one day
    Show answer and explanation
    Correct answer: A

    Communication compliance uses classifiers to detect inappropriate messages and routes them for review. Retention deletion, file-only DLP, and forwarding rules do not detect harassment in conversations.

  3. Question 21

    An insider risk analyst must review cases without seeing the names of users until a case is escalated. Which feature supports this?

    1. APrivacy settings that pseudonymize user names until an authorized escalation
    2. BAsking analysts to avoid looking at names in the case list for now
    3. CRemoving every open case from the review queue to protect privacy
    4. DShowing the full names and job titles of each reported user to every analyst by default
    Show answer and explanation
    Correct answer: A

    Pseudonymization hides identities until an authorized escalation, which balances privacy with investigation needs. Showing names by default, deleting cases, and relying on analyst discipline do not provide a technical control.

  4. Question 22

    Insider risk policies must cover only the users in one business unit. What should be configured?

    1. AScope the policy to that group of users
    2. BDisable the policy for the whole company
    3. CApply the policy to everyone and ignore the scope
    4. DCreate a separate tenant for the unit
    Show answer and explanation
    Correct answer: A

    Scoping the policy to a group applies monitoring only where it is required, which supports proportionality. Company-wide application ignores the requirement, and separate tenants or disabling the policy are disproportionate.

  5. Question 23

    Insider risk management must detect data theft patterns, but the privacy team requires that the investigation tools not reveal identities by default. Which setting addresses this?

    1. ADisplaying real user names, email addresses, and profile photos by default on insider risk dashboards
    2. BPseudonymized user names in the insider risk dashboards until a case is escalated
    3. CDisabling insider risk management as a privacy measure, which removes data theft detection
    4. DPublishing the active insider risk case list on the company intranet home page for managers
    Show answer and explanation
    Correct answer: B

    Pseudonymization hides identities by default and reveals them only when an authorized case requires it. Showing identities by default conflicts with privacy requirements, and disabling or publishing the feature fails the goal.

  6. Question 24

    A company wants to know whether users are sharing confidential files with personal accounts, and to use that information in insider risk investigations. Which signal source is most appropriate?

    1. AThe office's parking records and badge-entry logs for staff who commute by car in the garage
    2. BActivity signals from DLP and file activity that show sharing to unapproved destinations
    3. CThe employee's weekly lunch orders from the cafeteria, linked to purchasing patterns and spending habits
    4. DEach employee's personal social media posts and photos gathered to judge off-hours lifestyle habits
    Show answer and explanation
    Correct answer: B

    DLP and file activity signals show sharing to unapproved destinations, which is relevant to insider risk. Personal social media, lunch orders, and parking records are not appropriate or related signals.

Implement records management and retention (6 questions)

  1. Question 25

    A regulation requires that certain contracts be kept for seven years and then deleted. Which configuration best meets this requirement?

    1. AA retention policy that keeps contract content indefinitely by retaining items with no end date
    2. BA sensitivity label that marks contracts as Public, which classifies them
    3. CA calendar reminder email sent to the legal team each year so that staff can review contracts
    4. DA retention label with a seven-year period and deletion at the end of the period
    Show answer and explanation
    Correct answer: D

    A retention label with a defined period and a disposition action enforces both the keep and delete requirements automatically. Keeping everything forever violates the deletion rule, public labels do not manage retention, and reminders are manual.

  2. Question 26

    Records that are declared as regulatory records must not be changed or deleted by anyone, including administrators, until retention ends. Which setting provides this?

    1. AA label that changes the font and color of the document body text for display purposes
    2. BA standard retention label that end users can remove from items in the library by hand
    3. CA record label that locks the item so it cannot be edited or deleted until the retention period ends
    4. DA SharePoint folder with broad edit permissions granted to the Members group, so contributors can overwrite, rename, or move files
    Show answer and explanation
    Correct answer: C

    Record labels make items immutable during retention, which meets regulatory requirements. Standard labels can be removed by users, open folders allow edits, and font labels do not affect immutability.

  3. Question 27

    Content with a retention policy should be deleted automatically after its retention period when there is no reason to keep it. Which setting provides this?

    1. ASaving every item into an archive folder with no end date and no disposition action
    2. BA retention policy with a delete action after the retention period
    3. CA retention policy that retains content for the full period without a delete action
    4. DAsking users to delete content manually after a year by reviewing it
    Show answer and explanation
    Correct answer: B

    A retention policy with a delete action automates disposal after the retention period. Retain-only policies never dispose of content, manual deletion is unreliable, and endless archiving conflicts with data minimization.

  4. Question 28

    Items must be kept for legal reasons even after their retention label expires. Which feature applies?

    1. AAsking users to keep their own copies of the items in their mailboxes
    2. BA preservation or eDiscovery hold that overrides deletion
    3. CDisabling retention policies for the entire tenant temporarily
    4. DDeleting the retention label from the held items
    Show answer and explanation
    Correct answer: B

    A hold preserves items for legal reasons regardless of the retention schedule. Deleting labels, relying on user copies, and disabling retention break the legal preservation requirement.

  5. Question 29

    A project team wants to retain its Teams chat messages for two years and then delete them. Which policy configuration achieves this?

    1. ANothing, because Teams chats are retained indefinitely by default in the user's mailbox
    2. BA policy that only deletes Teams chat messages on a schedule and retains nothing for review
    3. CA sensitivity label configured to delete Teams chat messages one day after they are sent
    4. DA retention policy scoped to the chat locations with a two-year retention and deletion after the period
    Show answer and explanation
    Correct answer: D

    A retention policy scoped to Teams chats keeps messages for two years and then deletes them as specified. One-day deletion, delete-only settings, and assuming infinite retention do not match the requirement.

  6. Question 30

    Content must be retained for compliance but should not be visible to users in their mailboxes. Which configuration fits?

    1. AStoring the content in each user's personal folders, such as the Archive folder, so users can still browse it
    2. BA retention policy that retains content in a hidden location without requiring user action
    3. CA label configured with a public marking that makes content available to everyone inside the tenant
    4. DDeleting the content permanently through a retention policy with a delete action so that it cannot be seen
    Show answer and explanation
    Correct answer: B

    A retention policy retains content in a hidden preservation location while removing user-facing visibility. Public labels, deletion, and personal folders either expose or lose the content.