SC-401 alerts, audit and eDiscovery
After policies are in place you have to see what they catch. In SC-401’s domain Manage risks, alerts, and activities, the sub-area Manage information security alerts and activities covers Purview Audit, Activity explorer, DLP and insider-risk alerts, alerts in Microsoft Defender XDR and Defender for Cloud Apps, and eDiscovery searches. The exam asks which tool answers an investigative question and what licence or role is needed.
Microsoft Purview Audit
Audit records user and admin activity across Microsoft 365. There are two levels.
| Audit (Standard) | Audit (Premium) | |
|---|---|---|
| Purpose | Core activity logging and search | Longer retention, high-value events and investigation features |
| Retention | Default retention for audit records, shorter | Longer default for core workloads, and audit retention policies up to ten years with the right licence |
| Licensing | Included broadly | Needs the right licence assigned to each user |
Premium includes events that help investigations, such as when a mailbox item was accessed, and lets you create audit retention policies that keep selected records for a chosen period. The licence requirement is an exam favourite: the user must have the audit licence assigned for their events to receive Premium treatment. Searches in the Purview portal filter by date, user, activity and file or site, and the results can be exported.
Activity explorer
Activity explorer shows what happened to labelled and protected content: label applied, changed or removed; files copied to USB; DLP policy matches; retention label actions. It is the tool for questions such as how many files lost their Confidential label this month. It complements Content explorer, which shows the items themselves and their classifications.
Responding to alerts
| Source | Where you respond |
|---|---|
| DLP alerts | Alerts and incident management in the Purview portal; review the matched content, the rule and the user, then adjust the policy or follow up |
| Insider risk alerts | Insider Risk Management in the Purview portal; see the IRM guide |
| Purview alerts | Appear as incidents in Microsoft Defender XDR, correlated with other security alerts |
| Defender for Cloud Apps file policies | Alerts in the Defender portal, with actions such as quarantine or label |
Correlation is the point of the Defender XDR integration: a SOC analyst sees a DLP alert in the same incident as an identity or endpoint alert. Questions may ask where a data-protection specialist should respond versus where a SOC analyst works; this is where SC-200 and SC-401 overlap, as described in the comparison.
eDiscovery
eDiscovery in the Purview portal searches mailboxes, sites, Teams and other locations for content, places holds to preserve it, reviews results and exports them. You work inside a case, with permissions limited by role, and searches use keywords, dates, senders and conditions. Holds differ from retention policies in being case-bound and aimed at specific custodians or locations for a matter.
Three example questions
Question 1. An investigator must find out who accessed items in a compromised executive mailbox. The events are tied to the Premium audit feature. What must be true?
- A. An eDiscovery hold exists on the mailbox
- B. A retention label is applied to the mailbox
- C. The user has the Audit (Premium) licence assigned
- D. The mailbox is excluded from audit
Show answer
Answer: C
High-value events such as mailbox item access are captured for users who have the Audit Premium licence assigned. Audit retention policies, a retention label, or an eDiscovery hold do not generate those events.
Want more questions like this? Full SC-401 practice tests →
Question 2. Management asks how many files lost a sensitivity label last month and which users removed them. Which tool answers this most directly?
- A. Content explorer
- B. Activity explorer
- C. eDiscovery
- D. A retention policy
Show answer
Answer: B
Activity explorer reports label changes and removals with user and file details. Content explorer shows current items rather than activity history. An eDiscovery search finds content for legal matters, and a retention policy governs keeping or deleting data.
Want more questions like this? Full SC-401 practice tests →
Question 3. Auditors need to keep selected audit records of file activity for longer than the default period. What should you create?
- A. An audit retention policy
- B. A DLP policy
- C. A sensitivity label
- D. A retention label policy
Show answer
Answer: A
An audit retention policy specifies how long selected audit records are kept. A DLP policy, a sensitivity label and a retention label policy do not extend the retention of audit logs.
Want more questions like this? Full SC-401 practice tests →
What to practise
Run an audit search, open Activity explorer after labelling a few files, work one DLP alert and, if you can, trigger a test eDiscovery search with a hold. Then study how AI interactions appear in the same logs in the AI data protection guide.