SC-401 cheat sheet

Updated October 9, 2026

Last-minute reference for SC-401. The three domains each carry 30–35%, so revise all of them.

Exam facts

Duration100 minutes
Passing score700 / 1000
PriceSet per country or region; shown at booking
Languages7
RenewalFree, every 12 months
QuestionsNot published

Skill areas

AreaWeight
Implement information protection30–35%
Implement data loss prevention and retention30–35%
Manage risks, alerts, and activities30–35%

Requirement to answer

RequirementAnswer
Match actual values from a customer tableExact data match
Match documents built from a templateDocument fingerprinting
Recognise content by meaningTrainable classifier
Detect text in imagesOCR
Encrypt a document and travel with itSensitivity label with encryption
Label files already stored in SharePointService-side auto-labeling policy
Test before enforcingSimulation mode
Label has no effect for usersPublish it in a label policy
Label a Teams team or siteLabel scope includes groups and sites
Bulk-label on-premises sharesInformation Protection scanner, discovery first
Encrypted external emailMessage Encryption
Expiry and revocation of emailAdvanced Message Encryption
Block external sharing of card numbersDLP policy with block
Let user proceed with a reasonBlock with override
Control USB, print, pasteEndpoint DLP on onboarded devices
Monitor Chrome or FirefoxPurview browser extension
DLP rule that reacts to risky usersAdaptive Protection risk level
One rule for a whole locationRetention policy
Different rule per item, records, disposition reviewRetention label
Retention follows department changesAdaptive scope
Which retention rules apply herePolicy lookup
Detect departing-employee exfiltrationData theft by departing users + HR connector
Capture device activity of a suspectForensic evidence
Hide usernames from analystsPseudonymisation
Longer audit record retentionAudit retention policy (right licence)
Label and DLP activity historyActivity explorer
Search, hold, export for a legal mattereDiscovery
See and protect AI data useDSPM for AI (auditing on)

Precedence reminders

  • DLP across policies: the more restrictive action applies.
  • Retention: retention wins over deletion; the longest retention wins; explicit wins over implicit.

Traps

  • A retention label is not a sensitivity label.
  • Sensitivity labels protect; retention labels keep or delete.
  • Insider Risk Management detects; DLP blocks.
  • No onboarded device means no Endpoint DLP.
  • No auditing means little AI visibility.

Study more with the guides or the practice test.