Free SC-401 sample questions with answers
Here are five free SC-401 sample questions, one from each major area of the skills outline, with the answer and the reasoning behind it. Try each one before opening the answer. These are original scenario questions written against the official skills outline, not questions from the real exam.
Question 1. Contoso wants every document in a SharePoint library that contains a customer-number pattern to be labelled Confidential automatically, including the millions of files already stored there. Users must not be prompted. What should you configure?
- A. A default sensitivity label in the label policy
- B. A DLP policy with a block action
- C. An auto-labeling policy that uses a sensitive info type, tested in simulation mode first
- D. A retention label policy
Show answer
Answer: C
An auto-labeling policy (service-side) in Microsoft Purview labels files at rest in SharePoint and OneDrive, and you should run it in simulation mode before turning it on. A default label only applies to new or unlabelled items opened in Office apps and cannot look for a pattern. A DLP policy can detect the pattern but does not apply labels. A retention label policy applies retention, not sensitivity labels.
Want more questions like this? Full SC-401 practice tests →
Question 2. You must stop employees from copying files that contain credit card numbers to USB drives on corporate Windows 11 laptops. Copying to USB must be allowed for files without such data. What is required?
- A. A DLP policy scoped to the Exchange and SharePoint locations
- B. A DLP policy with the Devices location and a rule for copy to removable USB storage, with the laptops onboarded
- C. A sensitivity label policy that publishes a Confidential label
- D. An Insider Risk Management policy using the Data leaks template
Show answer
Answer: B
Endpoint DLP applies DLP rules to devices, and it can restrict copy to removable storage when a file matches a condition such as a sensitive info type. The devices must be onboarded to Purview. Exchange and SharePoint locations never see USB activity. A sensitivity label policy alone does not block copying. An Insider Risk policy only detects and scores activity; it does not block it.
Want more questions like this? Full SC-401 practice tests →
Question 3. Legal requires that all contracts stored in SharePoint be kept for seven years and then be reviewed by the records manager before deletion. Only documents tagged as contracts should follow this rule, not the rest of the site. What should you use?
- A. A retention policy on the entire SharePoint location
- B. A sensitivity label with encryption
- C. A DLP policy with an audit action
- D. A retention label with a disposition review, published or auto-applied to contracts
Show answer
Answer: D
A retention label applies to individual items and can trigger a disposition review at the end of the retention period. Publishing or auto-applying it targets only the contracts. A retention policy applies to a whole location and cannot single out items. A sensitivity label does not control retention. A DLP policy does not retain or delete content.
Want more questions like this? Full SC-401 practice tests →
Question 4. HR will notify security when an employee resigns. You want Insider Risk Management to raise a heightened-risk alert when that employee downloads and shares large numbers of files before the last working day. What must you configure to make the HR signal available?
- A. An HR connector that imports resignation dates, used with the Data theft by departing users template
- B. A retention label policy for HR documents
- C. A DLP rule that blocks all file sharing
- D. An audit retention policy of ten years
Show answer
Answer: A
The Data theft by departing users template relies on resignation or termination dates, which Insider Risk Management gets from an HR connector. Without it the policy cannot know the employee is leaving. A retention label policy, a DLP rule and an audit retention policy do not feed leaving-date signals into the risk model.
Want more questions like this? Full SC-401 practice tests →
Question 5. Before rolling out Microsoft 365 Copilot, the security team wants a Purview view of how sensitive data appears in AI interactions and one-click policies to start protecting it. Which solution should you use?
- A. eDiscovery
- B. An audit retention policy
- C. Data Security Posture Management (DSPM) for AI
- D. A retention label policy
Show answer
Answer: C
Data Security Posture Management for AI gives visibility into AI activity and offers recommended policies, and it depends on prerequisites such as auditing being on. Activity explorer shows activity data in general but is not the posture and policy workflow for AI. eDiscovery searches content for legal purposes. Audit retention policies only control how long audit records are kept.
Want more questions like this? Full SC-401 practice tests →
How did you do?
Questions 1 and 3 catch the most people. Auto-labeling policies versus default labels, and retention labels versus retention policies, are two of the most frequent pairs of look-alikes in the Purview feature set. If either slowed you down, read the information protection guide or the retention guide.
Question 2 depends on spotting that the requirement is about devices. Question 4 depends on knowing a prerequisite, and question 5 on knowing which Purview solution is the AI one.
What these questions have in common
None asks for a definition. Each states a requirement, offers several features that sound reasonable, and the answer depends on one detail: files at rest, USB, individual items, a leaving date, AI. That is how most of SC-401 reads. Underline the constraint before you look at the options.
For a longer check, take the 20-question practice test.