Free SC-401 practice test: 20 questions
Twenty questions across the three SC-401 skill areas: seven on information protection, seven on data loss prevention and retention, and six on risks, alerts and activities. The three domains carry equal ranges in the outline, so the split follows that. These are original scenario questions. Find the constraint in each scenario before you look at the options.
Implement information protection
Question 1. A bank must detect records that match actual customer account numbers stored in a database table, with minimal false positives. What should you create?
- A. A custom sensitive info type using only a regular expression
- B. A trainable classifier
- C. An exact data match sensitive info type
- D. A document fingerprint
Show answer
Answer: C
Exact data match sensitive info types compare content against hashed values from your own table, giving very precise detection. A regular expression alone matches the format and produces false positives. A trainable classifier recognises content by meaning. Document fingerprinting matches form-based documents, not values.
Want more questions like this? Full SC-401 practice tests →
Question 2. You want a classifier to recognise legal contracts by their content, when no fixed pattern exists. You have a collection of sample contracts. What should you use?
- A. A custom trainable classifier trained on the sample contracts
- B. An exact data match schema
- C. The built-in credit card number type
- D. A default sensitivity label
Show answer
Answer: A
A trainable classifier learns from sample documents to recognise a content category. EDM needs structured values, a built-in credit card type targets a specific pattern, and a default label does not detect anything.
Want more questions like this? Full SC-401 practice tests →
Question 3. Sensitivity labels must apply to Teams, Microsoft 365 groups and SharePoint sites, controlling external sharing and unmanaged device access. What must the label include?
- A. An item-only scope with encryption
- B. A DLP action
- C. A retention period
- D. A scope that includes groups and sites
Show answer
Answer: D
Container labels need the label scope to include groups and sites, which exposes site and group protection settings such as privacy, external sharing and unmanaged device access. An item-only scope cannot be applied to containers. DLP and retention settings do not provide these controls.
Want more questions like this? Full SC-401 practice tests →
Question 4. Users should not be able to lower the label on a document without explaining why, and every document must carry a label. What should you configure in the label policy?
- A. A retention label with disposition review
- B. Mandatory labelling and justification for label downgrades
- C. A DLP override with justification
- D. An audit retention policy
Show answer
Answer: B
Label policy settings include requiring a label on content and requiring justification when a label is lowered or removed. Retention labels, DLP overrides and audit retention policies do not enforce these behaviours on sensitivity labels.
Want more questions like this? Full SC-401 practice tests →
Question 5. Before enforcing a new service-side auto-labeling policy on all SharePoint sites, you want to see what would be labelled without changing files. What should you do?
- A. Turn the policy on and review later
- B. Publish the label to all users
- C. Run the policy in simulation mode and review the results
- D. Create a retention policy
Show answer
Answer: C
Auto-labeling policies can run in simulation mode, which reports matches without applying labels. Publishing the policy to all users or turning it on immediately changes files. A retention policy is a different feature.
Want more questions like this? Full SC-401 practice tests →
Question 6. Executives want to send encrypted email to external partners, and for some messages the access must expire and be revocable. Which capability fits?
- A. Purview Advanced Message Encryption
- B. Endpoint DLP
- C. Adaptive scopes
- D. Activity explorer
Show answer
Answer: A
Advanced Message Encryption adds features such as message expiry and revocation on top of Purview Message Encryption. Endpoint DLP, adaptive scopes and Activity explorer have nothing to do with encrypting mail.
Want more questions like this? Full SC-401 practice tests →
Question 7. Millions of files on on-premises file shares must be classified. You want the first run to only report what it finds. What should you deploy?
- A. A service-side auto-labeling policy
- B. Message Encryption
- C. eDiscovery
- D. The Information Protection scanner in discovery mode
Show answer
Answer: D
The Information Protection scanner supports discovery mode, which reports findings before you enforce labelling. Service-side auto-labeling covers Microsoft 365, Message Encryption is for email, and eDiscovery is a search tool.
Want more questions like this? Full SC-401 practice tests →
Implement data loss prevention and retention
Question 8. A DLP policy should warn users who share files containing national ID numbers externally, allow them to continue after giving a business reason, and record the reason. Which action fits?
- A. Block without override
- B. Block with override and justification
- C. Audit only
- D. A retention label
Show answer
Answer: B
Block with override lets users proceed after providing a justification, which is recorded. Plain block gives no option, audit only does not stop or warn, and a retention action does not apply.
Want more questions like this? Full SC-401 practice tests →
Question 9. A new DLP policy might disrupt business. How can you measure impact before it enforces actions?
- A. Turn it on for everyone
- B. Leave it off permanently
- C. Run it in simulation mode
- D. Assign more admin roles
Show answer
Answer: C
Simulation mode runs the policy and reports matches without enforcing actions, so you can tune it. Turning it on, setting it off or granting more roles do not give an impact preview.
Want more questions like this? Full SC-401 practice tests →
Question 10. Endpoint DLP must monitor copying of sensitive files to network shares on Windows laptops managed by Intune. What must you do first?
- A. Onboard the laptops to Microsoft Purview
- B. Publish a retention label
- C. Create an audit retention policy
- D. Enable Message Encryption
Show answer
Answer: A
Devices must be onboarded to Purview for Endpoint DLP to work, and Intune can deliver the onboarding. Retention labels, audit retention and Message Encryption do not affect device monitoring.
Want more questions like this? Full SC-401 practice tests →
Question 11. Endpoint DLP should allow printing of Confidential files to approved printers only. Which setting helps?
- A. Adaptive scopes
- B. Audit retention policy
- C. A trainable classifier
- D. Printer groups in Endpoint DLP settings
Show answer
Answer: D
Endpoint DLP settings let you define printer groups and then use them in rules to allow or block printing. Adaptive scopes, audit retention and trainable classifiers do not control printers.
Want more questions like this? Full SC-401 practice tests →
Question 12. All Teams chat messages must be deleted after two years, with no per-message decisions. What should you create?
- A. A retention label published to users
- B. A retention policy for Teams chats that deletes after two years
- C. A sensitivity label
- D. A DLP rule
Show answer
Answer: B
A retention policy for Teams chats with a deletion period handles a uniform rule for a whole location. A retention label would apply per item, a sensitivity label does not delete, and a DLP rule does not manage lifecycle.
Want more questions like this? Full SC-401 practice tests →
Question 13. An item has an explicit retention label of 10 years, and its site has a policy with a 5-year retention. Which applies?
- A. The 5-year policy replaces the label
- B. The two cancel each other
- C. The 10-year label governs
- D. Neither applies
Show answer
Answer: C
An explicitly applied retention label takes priority over an implicit policy applied to the location, and the longer retention applies in any case. The 5-year policy does not shorten it, and the two do not cancel.
Want more questions like this? Full SC-401 practice tests →
Question 14. You need to find out which retention policies and labels apply to a particular SharePoint site. What should you use?
- A. Policy lookup
- B. Content explorer
- C. Activity explorer
- D. eDiscovery
Show answer
Answer: A
Policy lookup shows which retention policies and labels apply to a user, group or site. Content explorer shows classified items, Activity explorer shows activity history, and eDiscovery searches content.
Want more questions like this? Full SC-401 practice tests →
Manage risks, alerts, and activities
Question 15. Insider Risk Management should alert on departing employees. Which two things are needed for the policy to work as designed?
- A. A retention label and a DLP policy
- B. An audit retention policy and a sensitivity label
- C. Message Encryption and an adaptive scope
- D. An HR connector and the Data theft by departing users template
Show answer
Answer: D
The departing users template uses a leaving date from an HR connector, and activity signals from onboarded devices and Microsoft 365. The other combinations rely on features that do not supply departure data.
Want more questions like this? Full SC-401 practice tests →
Question 16. Which Insider Risk Management feature captures device activity for a user under investigation, subject to approval?
- A. Notice templates
- B. Forensic evidence
- C. Priority user groups
- D. Policy indicators
Show answer
Answer: B
Forensic evidence captures device activity of selected users, with approval from a designated role. Notice templates send messages, priority user groups raise scrutiny, and policy indicators define activities to score.
Want more questions like this? Full SC-401 practice tests →
Question 17. You need a search for emails and Teams messages related to a legal matter, with content preserved and exported for counsel. What should you use?
- A. Activity explorer
- B. Policy lookup
- C. eDiscovery with a case, hold and export
- D. DSPM for AI
Show answer
Answer: C
eDiscovery supports searches, holds and exports within a case. Activity explorer shows activity data, Policy lookup shows retention rules, and DSPM for AI covers AI posture.
Want more questions like this? Full SC-401 practice tests →
Question 18. A SOC analyst wants Purview data-protection alerts correlated with other security alerts in one incident view. Where should they work?
- A. Microsoft Defender XDR
- B. Activity explorer
- C. Content explorer
- D. An audit retention policy
Show answer
Answer: A
Purview alerts surface in Microsoft Defender XDR, where they are correlated into incidents. Activity explorer and Content explorer are Purview tools without cross-product incidents, and an audit retention policy only retains logs.
Want more questions like this? Full SC-401 practice tests →
Question 19. Audit logs must be searchable for investigations, and some selected records must be kept for ten years. What should you do?
- A. Create a DLP policy
- B. Create a sensitivity label
- C. Create a retention label policy
- D. Create an audit retention policy and assign the required licence
Show answer
Answer: D
Audit retention policies set longer retention for selected records, and keeping them for ten years requires the appropriate licence. A DLP policy, sensitivity label and retention label policy do not control audit log retention.
Want more questions like this? Full SC-401 practice tests →
Question 20. Before enabling Microsoft 365 Copilot, you must see where sensitive data shows up in AI activity and deploy recommended protection quickly. Which Purview solution fits?
- A. Adaptive scopes
- B. DSPM for AI
- C. Exact data match
- D. The Information Protection scanner
Show answer
Answer: B
DSPM for AI offers visibility into AI interactions and recommended policies. Adaptive scopes target retention, EDM identifies exact values, and the Information Protection scanner handles on-premises files.
Want more questions like this? Full SC-401 practice tests →
Scoring yourself
Count correct answers per section. Below 70% in any section, return to that guide: information protection, DLP, retention, insider risk, alerts and audit or AI data protection. Consistent scores above 80% on different sets mean you are close to ready. See the study plan.