SC-401 information protection explained
Implement information protection is worth 30–35% of SC-401. It has three parts: classifying data so Microsoft Purview can recognise it, creating and publishing sensitivity labels that protect it, and extending protection to Windows, file shares and email. The questions ask which classification method or label setting fits a requirement, and what has to be in place for it to work.
Data classification
Sensitive info types and how to choose
| Method | Use it when |
|---|---|
| Built-in sensitive info type | The data is a standard format such as a credit card or national ID number |
| Custom sensitive info type | The data follows your own pattern: regular expression, keywords, optional checksum and supporting evidence |
| Document fingerprinting | You want to detect documents built from a standard form or template |
| Exact data match (EDM) | You must match actual values from a structured table, such as customer records, with very few false positives |
| Trainable classifier | The content is recognisable by its meaning, not a pattern, such as contracts or source code |
EDM works by hashing the sensitive table with a salt and uploading only the hashes, so the raw data never reaches the cloud. Trainable classifiers learn from a seed set of sample documents you provide; Microsoft also supplies pre-trained ones. Optical character recognition lets sensitive info types detect text inside images.
Data explorer and Content explorer show what has been found and labelled. Seeing the content itself in Content explorer needs a specific role, an easy detail to overlook.
Sensitivity labels
A sensitivity label is a tag with protection settings that travels with the item. You can scope it to items (files and emails), containers (Teams, Microsoft 365 groups, SharePoint sites) and Power BI items.
- Protection: encryption with assigned permissions or user-defined permissions, content marking (headers, footers, watermarks), and for containers privacy, external sharing and unmanaged device settings.
- Priority: labels are ordered; a higher-priority label is more sensitive. Sublabels group related labels.
- Publishing: a label does nothing until a label policy publishes it to users. The policy can set a default label, require labelling, and require justification to lower a label.
- Auto-labeling: two flavours. Client-side recommendations or automatic labels run in apps as users work. Service-side auto-labeling policies label files at rest in SharePoint and OneDrive and email in transit, and you should run them in simulation mode first.
- Roles: administering labels needs a Purview role such as Information Protection Admin.
Defender for Cloud Apps can apply labels to files in connected cloud apps as well.
Windows, file shares and Exchange
The Information Protection client and scanner
The Microsoft Purview Information Protection client lets users classify and protect files from Windows. The scanner applies bulk classification to on-premises file shares and SharePoint Server repositories. The standard approach is discovery mode first, review the results, then enforce.
Message Encryption
Purview Message Encryption lets users send encrypted email to recipients outside the organisation. Advanced Message Encryption adds features such as multiple branding templates, message expiry and revocation. A sensitivity label with encryption or a mail flow rule can trigger encryption.
Three example questions
Question 1. You need to detect documents that match your standard employment contract template, even when names and figures differ, without writing patterns. What should you create?
- A. An exact data match schema
- B. A document fingerprint sensitive info type from a blank copy of the template
- C. A retention label
- D. A built-in credit card sensitive info type
Show answer
Answer: B
Document fingerprinting converts a standard form into a sensitive info type that matches documents built from that template. A trainable classifier needs sample documents and is meant for content type by meaning, which could work but is heavier than needed here. EDM matches exact values from a table. A built-in sensitive info type cannot know your template.
Want more questions like this? Full SC-401 practice tests →
Question 2. A sensitivity label was created with encryption and content marking but users cannot see it in Word. What is the most likely cause?
- A. Encryption is not compatible with Word
- B. Content marking must be disabled
- C. A DLP policy is missing
- D. The label has not been published in a label policy
Show answer
Answer: D
A label must be published to users through a label policy before it appears in apps. Adding encryption does not publish it. Content marking is a setting, not a prerequisite. A DLP policy does not control label visibility, and an auto-labeling policy would apply the label automatically but is not what makes it selectable.
Want more questions like this? Full SC-401 practice tests →
Question 3. You must classify files on an on-premises Windows file share and label them in bulk. You want to review what would be labelled before any file changes. What should you do?
- A. Deploy the Information Protection scanner and run it in discovery mode first
- B. Enable Purview Message Encryption
- C. Create a service-side auto-labeling policy for SharePoint
- D. Create an adaptive retention policy
Show answer
Answer: A
The Information Protection scanner supports a discovery mode that reports what it finds and would label before you switch to enforcement. Message Encryption is for email. A service-side auto-labeling policy works on Microsoft 365 locations, not on-premises shares. A retention policy does not classify or label.
Want more questions like this? Full SC-401 practice tests →
What to practise
Build a custom sensitive info type, publish two labels, and run an auto-labeling policy in simulation. Then read the DLP guide, because DLP often consumes the same sensitive info types and labels. For more questions use the practice test.