SC-401 data loss prevention explained
Data loss prevention is the first half of the 30–35% domain Implement data loss prevention and retention. A Purview DLP policy decides where to watch, what counts as sensitive, and what to do when a match is found. The exam asks you to design a policy for a requirement, to predict what happens when several policies or rules apply, and to configure Endpoint DLP on devices.
Building a DLP policy
A policy has four moving parts:
- Locations: Exchange email, SharePoint, OneDrive, Teams chat and channel messages, devices, Defender for Cloud Apps instances, on-premises repositories, and others including AI-related locations.
- Conditions: content contains a sensitive info type, a sensitivity label, or a trainable classifier; shared with people outside the organisation; and so on.
- Actions: audit only, block, block with override and a business justification, restrict access, send user notifications and policy tips, and generate alerts and incident reports.
- Mode: simulation, with or without policy tips, then on. Run new policies in simulation first and tune them from the results.
Roles matter too: DLP administration uses Purview roles, and alert investigation needs its own permissions.
Rule and policy precedence
Within a policy, rules have a priority. Rules are evaluated in order, and a higher-priority matching rule’s actions can take precedence over lower ones; you can also stop processing further rules. Across policies, every matching policy is evaluated, and where actions conflict the more restrictive action applies. Questions often show two policies and ask which action the user sees.
Adaptive Protection in DLP
Adaptive Protection comes from Insider Risk Management. It assigns users an insider risk level, and a DLP policy can use that level as a condition, so that a user at elevated risk is blocked from an action that a low-risk colleague can perform. It needs Insider Risk Management configured first.
DLP with Defender for Cloud Apps
File policies in Microsoft Defender for Cloud Apps can scan files in connected SaaS apps. They can use DLP content inspection so that cloud app files are evaluated by the same content rules.
Endpoint DLP
Endpoint DLP extends DLP to Windows and macOS devices, covering actions such as copying to USB, copying to a network share, printing, uploading to a cloud service, and pasting into a browser.
| Topic | What to know |
|---|---|
| Onboarding | Devices must be onboarded, for example through Microsoft Intune, group policy, scripts or Defender for Endpoint |
| Browsers | Microsoft Edge has native support; other browsers need the Microsoft Purview extension |
| Settings | Groups for unallowed apps and browsers, service domains, file path exclusions, removable storage, printers and network shares |
| Advanced rules | Different actions per activity, such as audit for print, block for USB |
| Just-in-time protection | Evaluates files in real time on devices before the policy has scanned them, with a configured fallback action |
| Monitoring | Activity explorer and DLP alerts show endpoint activities |
Three example questions
Question 1. A policy blocks external email with credit card numbers. A second, lower-risk policy only audits the same content. A user emails such data to an outside recipient. What happens?
- A. The email is sent because the audit policy overrides the block
- B. The policies cancel each other out
- C. The email is blocked because the more restrictive action applies
- D. The email is held for the next policy refresh
Show answer
Answer: C
When several policies match, the more restrictive action wins, so the email is blocked; the audit-only policy does not weaken it. Saying that both policies cancel out, or that the lowest-priority policy wins, misdescribes how DLP resolves conflicts. The message is not allowed because a block action matched.
Want more questions like this? Full SC-401 practice tests →
Question 2. You want users in the Finance group to be blocked from uploading labelled files to personal cloud storage only when their insider risk level is elevated. What should you use?
- A. A retention label policy
- B. A DLP policy using the insider risk level condition from Adaptive Protection
- C. A static Entra group excluded from the policy
- D. An audit retention policy
Show answer
Answer: B
Adaptive Protection exposes insider risk levels that a DLP policy rule can use as a condition, which is exactly this scenario. Retention labels do not control uploads. A static group exclusion does not respond to changes in risk. An audit retention policy only controls log retention.
Want more questions like this? Full SC-401 practice tests →
Question 3. Endpoint DLP rules work in Edge but users in Chrome can still paste sensitive text into websites unmonitored. What is the most likely fix?
- A. Deploy the Microsoft Purview extension to Chrome
- B. Onboard the devices again
- C. Create a retention policy for Chrome
- D. Place the users on eDiscovery hold
Show answer
Answer: A
Chrome needs the Microsoft Purview extension for Endpoint DLP to monitor browser activity; Edge supports it natively. Onboarding is already working because Edge is monitored. A retention policy and an eDiscovery hold have no effect on paste activity.
Want more questions like this? Full SC-401 practice tests →
What to practise
Create one DLP policy for email and one for devices, run both in simulation, then read the alerts and activity. Retention, the other half of the domain, is covered in the retention guide, and the policies you built feed alerts discussed in the alerts and activities guide.