Free SC-401 Practice Test Questions and Answers (2026)

To analyze AI interaction events, including the content of prompts and responses, within Microsoft Purview, a user needs permissions to access the Content Explorer. Microsoft Purview uses a two-level access control model for Content Explorer to adhere to the principle of least privilege. The Content Explorer List Viewer role grants permission to see the list of items (in this case, AI interactions). The Content Explorer Content Viewer role grants the additional permission to open and view the actual content of those items. Therefore, User1 requires both roles to perform the complete task of analyzing the prompts and responses.

A. Information Protection Analysts: This role is for managing data classification, sensitivity labels, and data loss prevention (DLP) policies, not for viewing content in Content Explorer.

B. Security Reader: This is a broad Microsoft Entra ID and Microsoft Defender XDR role providing read-only access to various security features, but it does not grant specific permissions to Content Explorer.

D. Insider Risk Management Investigators: This is a highly privileged role specific to the Insider Risk Management solution and is not the least-privileged role required for viewing AI interactions in DSPM.

1. Microsoft Learn. "Get started with content explorer." Microsoft Purview documentation. Under the "Permissions" section, it states: "To get access to content explorer, an admin must add you to the Content Explorer List Viewer role group. To also see the content of the files in content explorer, you must be a member of the Content Explorer Content Viewer role group."

2. Microsoft Learn. "Investigate AI interactions in Microsoft Purview." Microsoft Purview documentation. This document explicitly states the required permissions for the task described in the question: "To view the content of prompts and responses, you need to be a member of the Content Explorer Content Viewer role group. To view the list of interactions, you need to be a member of the Content Explorer List Viewer role group."

3. Microsoft Learn. "Permissions in the Microsoft Purview compliance portal." Microsoft Purview documentation. This document details the various role groups, confirming that the Content Explorer roles are distinct and separate from roles like Information Protection Analysts or Insider Risk Management Investigators, reinforcing the principle of least privilege.

Forensic evidence capturing in Microsoft Purview Insider Risk Management is an add-on feature that requires specific licensing capacity. After purchasing the add-on, the first administrative action required to activate the feature is to claim this capacity within the Microsoft Purview compliance portal. This step makes the forensic evidence functionality available for configuration within your tenant. Without claiming the capacity, the settings to enable and configure forensic evidence capturing for user devices will not be accessible, making it the necessary initial step.

A. The information protection scanner discovers and classifies sensitive data on-premises; it is not a prerequisite for enabling the device-based forensic evidence feature.

C. Adaptive Protection is a feature that dynamically adjusts Data Loss Prevention (DLP) policies based on user risk levels, not a requirement for forensic evidence.

D. Creating priority user groups is a step for targeting insider risk policies, which is performed after the core features, like forensic evidence, are enabled.

1. Microsoft. (n.d.). Learn about forensic evidence for insider risk management. Microsoft Learn.

Reference Point: In the "Prerequisites" section, the documentation explicitly states, "If you've purchased forensic evidence add-on capacity, you must first claim your capacity in the Microsoft Purview compliance portal." The subsequent section, "Claim your capacity," details this as the initial configuration step.

2. Microsoft. (n.d.). Get started with insider risk management. Microsoft Learn.

Reference Point: Under the "Deployment" heading, "Step 2: Enable permissions and forensic evidence (if needed)" outlines the initial setup tasks. It confirms that enabling forensic evidence is a distinct, early step in the configuration process, which involves meeting prerequisites like licensing and claiming capacity.

To create a custom Sensitive Information Type (SIT) in Microsoft Purview, specific pattern components are used. The Primary element is the core requirement, such as a regular expression or keyword list that defines the alphanumeric string. Character proximity defines the search window (e.g., 300 characters by default, but adjustable) where Supporting elements (like the "SN" abbreviation) must be found to increase the confidence level. Finally, Additional checks are used to refine results and prevent false positives by incorporating "Exclude" lists or specific validation logic to ignore test data like "1111111111".

Microsoft Learn: "Learn about sensitive information types," Section: Components of a sensitive information type.

Microsoft Learn: "Create a custom sensitive information type in the Microsoft Purview compliance portal," Section: Patterns.

Microsoft Learn: "Sensitive information type entity definitions," Section: Primary element and Supporting element.

Microsoft Learn: "Customize a built-in sensitive information type," Section: Proximity.

The Set-AuditConfig cmdlet is used to configure organization-wide settings for the unified audit log, such as the audit level or ingestion status. It does not enable or disable auditing for individual mailboxes. The problem states that audit log searches for a specific mailbox (User1) are blank, indicating that auditing for that particular mailbox is likely disabled. The correct procedure to ensure future sign-ins and other actions are logged for a specific mailbox is to enable auditing directly on that mailbox object using the Set-Mailbox -Identity User1 -AuditEnabled $true command. Therefore, the proposed solution is incorrect.

A: This is incorrect because the Set-AuditConfig command does not target or enable auditing for a specific user's mailbox. It manages the global configuration of the unified audit log service.

1. Microsoft Purview Documentation

"Enable or disable mailbox auditing": This document explicitly states that the Set-Mailbox -AuditEnabled parameter is used to turn on or off mailbox auditing for specific user mailboxes. It confirms this is the correct method to resolve the issue described.

URL: https://learn.microsoft.com/en-us/purview/audit-mailboxes#enable-or-disable-mailbox-auditing

2. Microsoft PowerShell Documentation

"Set-Mailbox": The official documentation for the Set-Mailbox cmdlet details the -AuditEnabled parameter

which "specifies whether to enable or disable mailbox auditing for the mailbox."

URL: https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailbox?view=exchange-ps#parameters (See -AuditEnabled parameter description).

3. Microsoft PowerShell Documentation

"Set-AuditConfig": The documentation for Set-AuditConfig shows its purpose is to "configure the unified audit log." Its parameters

such as -UnifiedAuditLogIngestionEnabled

affect the entire service

not individual mailboxes.

URL: https://learn.microsoft.com/en-us/powershell/module/exchange/set-auditconfig?view=exchange-ps

The proposed solution is incorrect. Endpoint Data Loss Prevention (DLP) functionality is natively integrated into the Windows 10 and Windows 11 operating systems. To enable Endpoint DLP policies to protect content on these computers, the devices must be onboarded into the Microsoft Purview compliance portal. The installation of the Microsoft Purview Information Protection (MIP) client is not the required step to enable the Endpoint DLP engine. The MIP client's primary function is for classification and labeling, and its functionality is increasingly being built directly into Microsoft 365 Apps, making the separate client unnecessary for this specific goal.

(Note: The provided question format with two "Yes" options is non-standard. Assuming a standard "A. Yes / B. No" format, the correct answer is No.)

A. Yes: This is incorrect because installing the Microsoft Purview Information Protection client does not enable the Endpoint DLP engine on Windows 11. The required action is device onboarding into Microsoft Purview.

1. Microsoft Learn. (2024). Get started with Endpoint data loss prevention. "For devices running Windows 10

Windows 11 and macOS (three latest released versions)

you don't need to install any additional software. Everything is already included." This source explicitly states that no additional client software is needed for Endpoint DLP on Windows 11.

URL: https://learn.microsoft.com/en-us/purview/endpoint-dlp-getting-started

2. Microsoft Learn. (2024). Onboard devices into Microsoft Purview solutions. This document details the required onboarding process for devices to be managed by Purview solutions

including Endpoint DLP

confirming that onboarding

not client installation

is the key step.

URL: https://learn.microsoft.com/en-us/purview/device-onboarding-overview

3. Microsoft Learn. (2024). Microsoft Purview Information Protection client - Version release history & support policy. This page describes the purpose of the MIP client

which is focused on applying sensitivity labels

confirming its role is distinct from enabling the core Endpoint DLP engine.

URL: https://learn.microsoft.com/en-us/purview/information-protection-client-version-release-history

To meet the requirement of applying a 10-year retention and deletion period to documents containing a specific identifier (Patent ID), you must first create a retention label that defines these settings. Since labels do not apply themselves, the next logical step is to create a retention label policy (specifically an auto-labeling policy for the Patent ID) to publish or apply the label to the content. Finally, to satisfy the strict regulatory requirement that the policy "must never be disabled or deleted by anyone," you must add a preservation lock. Once a preservation lock is applied to a policy, it cannot be disabled, deleted, or have its retention period shortened by any administrator, including Global Admins.

Microsoft Learn: "Learn about retention policies and retention labels" - Section: Retention labels; Subsection: Auto-apply labels. This describes the creation and deployment workflow.

Microsoft Learn: "Use Preservation Lock to restrict changes to retention policies and retention label policies." - Overview section. Explains that Preservation Lock prevents the deletion or turning off of the policy to comply with regulations like SEC Rule 17a-4.

Microsoft Learn: "Create and configure retention labels." - Step-by-step guidance on creating the label and its associated policy.

Microsoft Purview Documentation: "Regulatory requirements for information governance" - Section on Immutable storage and Preservation Lock.

Passwordless sign-in provides phishing-resistant authentication without interactive MFA prompts.

• The Rights Management connector that User2 installs and the AIP scanner that runs under User3 both support (and Microsoft recommends) certificate-based, app-only authentication—classified by Microsoft Entra ID as a passwordless method.

• Enabling passwordless for these two accounts therefore maximises sign-in security while still allowing the non-interactive services to obtain tokens.

User1 needs only to test the client interactively and can continue to use the normal, MFA-protected sign-in already configured for the tenant.

Why the other options are wrong (≤30 words each):

A. Removing MFA weakens security and is unnecessary; service components can use certificate-based authentication instead.

C. Same weakness as A and excludes the tester, further reducing security.

D. FIDO2/passkey requires interactive user presence; a Windows service (scanner account) cannot complete this flow.

1. Microsoft Learn – “Passwordless authentication methods in Microsoft Entra ID”

section “Certificate-based authentication”: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless#certificate-based-authentication

2. Microsoft Learn – “Deploy the Azure Information Protection unified labeling scanner”

section “Configure the scanner to use app-only authentication”: https://learn.microsoft.com/en-us/azure/information-protection/deploy-aip-scanner#step-5-configure-aip-authentication

3. Microsoft Learn – “Deploy and configure the Microsoft Rights Management connector”

section “How the connector authenticates”: https://learn.microsoft.com/en-us/azure/information-protection/ConfigureRMSConnector#how-the-connector-authenticates

To classify all the specified information, a minimum of five Sensitive Information Types (SITs) are required. Four of these are built-in SITs provided by Microsoft, and one must be a custom SIT.

1. Credit Card Number: A built-in SIT.

2. U.K. National Health Service Number: A built-in SIT.

3. All Physical Addresses: A built-in SIT that can detect UK addresses.

4. User Credentials: A built-in SIT for sign-in information.

5. Custom Project SIT: A single custom SIT can be created using a keyword list to detect all three project names ("Project Tailspin," "Project Contoso," "Project Falcon").

This combination covers all requirements with the minimum number of SITs.

A. 2: This is insufficient as it cannot cover the five distinct categories of sensitive information described in the scenario.

C. 7: This is incorrect. It likely results from counting each project keyword as a separate SIT, which is inefficient, or by double-counting repeated information types.

D. 10: This number is arbitrarily high and does not align with the principle of using the minimum number of SITs required.

1. Microsoft Learn. (2024). Sensitive information type entity definitions. This official documentation lists the built-in SITs

including "Credit Card Number

" "U.K. National Health Service (NHS) Number

" "All Physical Addresses

" and "User Credentials."

URL: https://learn.microsoft.com/en-us/purview/sensitive-information-type-entity-definitions

2. Microsoft Learn. (2024). Create custom sensitive information types in the Microsoft Purview compliance portal. This document explains that a single custom SIT can be configured with a list of keywords

making it unnecessary to create separate SITs for each project name.

URL: https://learn.microsoft.com/en-us/purview/create-custom-sensitive-information-types

To implement a custom trainable classifier in Microsoft Purview, you must follow a specific three-phase lifecycle: Seed, Test, and Publish.

1. Create: You first create the classifier by providing a seed set of at least 50 positive examples (documents that match the category).
2. Test: Once the initial training is complete, the classifier enters a "Need test items" state. You must upload and review test items, providing feedback by marking them as "Match" or "Not a Match" to refine accuracy.
3. Publish: Only after the classifier meets the required accuracy thresholds and is manually published can it be used as a condition in retention label or data loss prevention (DLP) policies.

Microsoft Purview Documentation: "Learn about trainable classifiers," Section: Process for creating a custom classifier. [Official Vendor Documentation]

Microsoft Purview Documentation: "Create a custom trainable classifier," Section: How to create a trainable classifier. [Official Vendor Documentation]

Microsoft Learn: "Get started with trainable classifiers," Section: Testing and publishing. [Official Vendor Documentation]

In Microsoft Purview Insider Risk Management, Adaptive Protection assigns risk levels based on default conditions related to the frequency and severity of triggered alerts within a 7-day window. User1 is assigned a Minor risk level because the condition for "at least one data exfiltration activity with high severity score" corresponds to this entry-level tier. User2 is assigned an Elevated risk level because they meet the criteria for "at least three risky user activities within seven days" with high severity scores. User3 is assigned a Moderate risk level because they meet the criteria for "at least two data exfiltration activities within seven days" with high severity scores. These levels dynamically automate DLP controls to prevent data loss.

Microsoft Official Documentation: "Help minimize insider risks by using Adaptive Protection." Microsoft Purview (Compliance). Section: "Adaptive Protection levels and conditions."

Microsoft Official Documentation: "Configure adaptive protection in Microsoft Purview (preview)." Microsoft Learn. Section: "Risk levels for Adaptive Protection."

Microsoft Official Documentation: "Insider Risk Management settings - Adaptive Protection." Microsoft Purview Guidance. Details the default logic: 1 exfiltration event = Minor; 2 exfiltration events = Moderate; 3+ risky activities = Elevated.

The retention policy is configured to retain items for 7 years from their creation date and then automatically delete them.

1. File1.docx (Created Jan 15, 2068): The 7-year retention period expires on January 15, 2075. Since the policy's action is to "Delete items automatically," the file is designated for automatic deletion after its retention period ends.

2. File2.docx (Created Feb 20, 2070): The 7-year retention period ends on February 20, 2077. As of the current date (Jan 01, 2075), the file is within its retention period and is therefore actively being retained by the policy.

3. File3.docx (Created Mar 25, 2074): This file is within its retention period. A fundamental principle of retention policies is to prevent permanent deletion. If a user attempts to delete this file, a copy is preserved in the site's Preservation Hold library, meaning the user cannot permanently delete it.

1. Microsoft Purview Documentation - Learn about retention policies and retention labels: "If content is subject to a retention policy... a copy of that content is retained in a secured location... For SharePoint and OneDrive sites

the original file is moved to the Preservation Hold library." This explains why a user cannot permanently delete File3.docx.

URL: https://learn.microsoft.com/en-us/purview/retention#how-retention-policies-and-retention-labels-work-with-content-in-place

2. Microsoft Purview Documentation - Retention policy and retention label actions: "The delete action is a permanent deletion... For SharePoint and OneDrive

the timer job that runs periodically identifies items whose retention period has expired

and these items are moved to the second-stage Recycle Bin

where they are permanently deleted after 93 days." This confirms the automatic deletion process for File1.docx.

URL: https://learn.microsoft.com/en-us/purview/retention-policy-and-retention-label-actions#deleting-items

3. Microsoft Purview Documentation - How retention works for SharePoint and OneDrive: "When a retention policy is applied to a SharePoint site... content can't be permanently deleted... during the retention period because it's retained in the Preservation Hold library." This reinforces the behavior for File3.docx.

URL: https://learn.microsoft.com/en-us/purview/retention-policies-sharepoint#how-retention-works-for-sharepoint-and-onedrive

Statement 1: Yes. Since the file was created on January 1, 2021, and the retention policy is configured for 5 years, the retention period does not end until January 1, 2026. On January 15, 2023, the file is still within its lifecycle. Unless explicitly deleted by a user, it remains accessible in its original location.

Statement 2: Yes. When a file subject to a retention policy is deleted, it is moved to the Preservation Hold library (PHL). Because the 5-year retention period (ending January 1, 2026) is still active on April 15, 2023, an administrator can recover the file from the PHL or through eDiscovery tools.

Statement 3: No. The retention period is 5 years from the date of creation (January 1, 2021), which expires on January 1, 2026. By April 15, 2026, the retention period has ended. Once the period expires, the policy no longer protects the file from permanent deletion, and the file would typically be purged from the PHL.

Official Vendor Documentation: Learn about retention for SharePoint and OneDrive, Microsoft Purview (September 2025). This specifies that content deleted during a retention period is moved to the Preservation Hold library.

Official Vendor Documentation: How retention works for SharePoint and OneDrive, Microsoft Learn. Explains that the retention period timer starts based on the "Created" or "Last Modified" date as configured.

Technical Specification: Microsoft Purview Data Lifecycle Management Principles, Microsoft Learn (2025). Outlines that "Retention takes precedence over deletion," ensuring files are recoverable until the specified period (5 years in this case) concludes.

To meet the technical requirements for identifying and protecting confidential documents (specifically those following a specific pattern like "Confidential" followed by a seven-digit number), you must first define what the system should look for. A Sensitive Information Type (SIT) is the foundational component in Microsoft Purview for identifying specific data patterns.

Since the requirement involves a specific string ("Confidential") followed by a fixed-length numeric pattern (seven digits), a Regular Expression (Regex) is the most precise and appropriate detection method. Other methods like dictionaries or keywords are less effective for variable numeric strings, and file type detection does not inspect content patterns. Once the SIT is created, it can then be used within sensitivity labels or DLP policies.

Microsoft Purview Documentation: "Custom sensitive information types" section. Details the workflow of creating a SIT before applying it to policies. [Document ID: sensitive-information-type-learn-about]

Microsoft Purview Documentation: "Create custom sensitive information types in the compliance portal." Specifically covers the use of Primary patterns and Regular expressions (Regex) for pattern matching. [Section: "Part 2: Add a pattern"]

Microsoft Purview Documentation: "Regulatory compliance and data classification." Explains that SITs are the building blocks for labeling and data loss prevention strategies. [Section: "Data Classification"]

Microsoft 365 Copilot operates within the user's security context and respects all existing access controls and permissions. Sensitivity labels are the primary mechanism in Microsoft Purview for classifying data and applying protection policies, including encryption and access rights. By applying a restrictive sensitivity label to the documents in Channel1, you ensure that only authorized users can decrypt and view the content. Consequently, Copilot will not be able to access this content and include it in responses for any user who lacks the necessary permissions defined by the label, directly fulfilling the requirement.

A. data loss prevention (DLP): DLP policies are designed to prevent data exfiltration or improper sharing (e.g., blocking emails with sensitive data), not to control an internal service's access to content for authorized users.

B. Microsoft Purview insider risk management: This tool focuses on detecting and managing risky user behaviors and activities, not on applying persistent access controls directly to data items.

C. Microsoft Purview Information Barriers: These are used to restrict communication and collaboration between specific groups of users, not to control access to file content based on its sensitivity.

1. Microsoft Learn. "Data

Privacy

and Security for Microsoft 365 Copilot." This document explicitly states

"The protections you’ve configured with sensitivity labels... are respected by Copilot for Microsoft 365. For example

if you’ve applied a sensitivity label to a document that encrypts it

a user who doesn’t have permissions to decrypt that document can’t use Copilot for Microsoft 365 to summarize it."

URL: https://learn.microsoft.com/en-us/microsoft-365-copilot/microsoft-365-copilot-privacy

2. Microsoft Learn. "Get your organization ready for Microsoft 365 Copilot." This guide recommends implementing data protection controls

specifically mentioning sensitivity labels

as a key step to prepare for Copilot. It advises

"Use sensitivity labels to apply protection policies like encryption to your most sensitive content."

URL: https://learn.microsoft.com/en-us/microsoft-365-copilot/get-ready-for-microsoft-365-copilot

3. Microsoft Learn. "Learn about sensitivity labels." This document details how sensitivity labels work to classify and protect data by applying markings and encryption

which forms the basis of the access control that Copilot respects.

URL: https://learn.microsoft.com/en-us/purview/sensitivity-labels