SC-401 exam format: questions, score and cost
SC-401 gives you 100 minutes, requires a scaled score of 700 out of 1000 to pass, is offered in seven languages and is priced per country at the booking step. Microsoft does not publish the number of questions. This page collects what Microsoft does publish and what it means for how you prepare.
| Exam title | Administering Information Security in Microsoft 365 |
| Certification | Microsoft Certified: Information Security Administrator Associate |
| Level | Intermediate (associate) |
| Duration | 100 minutes |
| Passing score | 700 on a scale of 1–1000 |
| Number of questions | Not published by Microsoft |
| Languages | English, Portuguese (Brazil), French, German, Japanese, Chinese (Simplified), Spanish |
| Delivery | Pearson VUE, proctored |
| Price | Set per country or region; shown at booking |
| Renewal | Every 12 months, free, on Microsoft Learn |
| Prerequisites | None required; Microsoft expects familiarity with Microsoft 365, PowerShell, Entra, the Defender portal and Defender for Cloud Apps |
The three domains
| Domain | Weight |
|---|---|
| Implement information protection | 30–35% |
| Implement data loss prevention and retention | 30–35% |
| Manage risks, alerts, and activities | 30–35% |
The ranges overlap completely, which means the exam is roughly a third each. In practice the sub-topics are not equal in size. Data loss prevention and retention is two big feature areas sharing one weight, and risks, alerts and activities contains Insider Risk Management, audit, eDiscovery and DSPM for AI. Expect fewer questions per individual feature than the weights suggest, and plan to be competent at all of them rather than expert at one.
The October 2026 update
Microsoft’s study guide lists the skills measured as of October 28, 2026. The certification page, read on the same day, says the English version will be updated on October 14, 2026, so the two Microsoft pages give different dates. The part of the change log available when this guide was written marks the audience profile and the information protection domain as unchanged and the sensitivity label objectives as a minor change. The three domains and their 30–35% ranges stay the same.
Practical advice: open the current study guide, read the objective list, and book with the date of your sitting in mind. Localised versions follow the English version by roughly eight weeks, so in another language you may still get the older outline for a while. Third-party material written in 2025 is likely to be missing the AI-services objectives entirely.
A practice assessment exists
SC-401 has a free official practice assessment on Microsoft Learn. Use it once early to see which domain is weakest and once late to confirm readiness. It shows the style and difficulty of the questions. The exam sandbox shows the interface and the question types.
Question types
Expect the usual Microsoft mix: single and multiple-answer multiple choice, drag-and-drop ordering (for instance the order of steps to publish a label), dropdown completion, yes/no statement series on one scenario, and case studies with several questions sharing a long scenario. Microsoft notes that the exam may have interactive components.
What a typical question looks like
Questions are scenario based and name features exactly: a trainable classifier versus an exact data match classifier, a retention policy versus a retention label, Endpoint DLP versus Exchange DLP, an auto-labeling policy versus a default label. The skill being tested is choosing the right tool for a stated requirement, including prerequisites such as licences, roles and onboarded devices.
The passing score is scaled
700 of 1000 is not 70% correct. Microsoft scales scores and does not publish the conversion. Aim for a consistent 80% or more on realistic practice questions.
Time management
100 minutes is comfortable if you do not stall. Read the requirement line first, then the options. If a case study appears, keep a reserve for it. Do not spend more than two minutes on one item.
Preview features and extra time
Most questions cover generally available features; Microsoft says preview features may appear if commonly used. Purview changes fast, so rely on the current Purview documentation rather than old blog posts. If the exam is not offered in your language you can request 30 extra minutes; arrange that before booking.
Retakes and renewal
After a failed attempt you can retake after 24 hours; later retakes wait longer under Microsoft’s retake policy. Once you pass, the associate certification is valid for 12 months and renews through a free online assessment on Microsoft Learn. See the exam day guide and the certification costs overview.