About these questions
These five questions are original. We wrote them in the style of the SC-401 skills measured, so each tests one idea that is easy to mix up with a neighbor. They are not questions from the exam, and the exam will word things differently. Domains 1 and 3 get two questions each and domain 2 gets one.
How to use these
Try each question without looking at your notes, and pick an answer before you open the explanation. Then read the explanation even when you were right, because the reason the closest wrong option fails is where the learning is. Note any domain where you slipped and revisit it on the domains explained page.
Question 1 (Implement information protection)
A manufacturer connected a third-party cloud storage app to Microsoft Defender for Cloud Apps and turned on the setting that automatically scans new files for sensitivity labels and content inspection. New and edited files are now being scanned, but several years of older files in the app have never been scanned. The solution must use Defender for Cloud Apps. What should you do?
- A. Wait for the automatic scan to reach the older files
- B. Create a Microsoft Purview auto-labeling policy and run it in simulation mode
- C. Turn the automatic scan setting off and on again
- D. Create a file policy that has content inspection enabled
Show the answer and explanation
Correct answer: D. The automatic scan setting covers new and modified files only. To scan files that already exist, you need at least one file policy with content inspection turned on. Toggling the setting or waiting does not change what it covers. A Purview auto-labeling policy in simulation is the closest wrong option: it previews labeling in Microsoft 365 locations, so it neither scans the third-party app nor meets the requirement to use Defender for Cloud Apps.
Question 2 (Implement information protection)
A company has two SharePoint sites. Project Harbor is a team site connected to a Microsoft 365 group. Lighthouse is a communication site that is not connected to a group. The sensitivity label on each site must be changed by people who are responsible for that site, without involving a tenant administrator. Which two users can change the labels? Choose two.
- A. A member of the Microsoft 365 group for Harbor
- B. A SharePoint site admin of Lighthouse
- C. A visitor of the Lighthouse site
- D. An owner of the Microsoft 365 group for Harbor
- E. A Lighthouse member who has Edit permissions
Show the answer and explanation
Correct answers: B and D. On a group-connected site, the label is changed by an owner of the Microsoft 365 group. On a site that is not group-connected, such as a communication site, the person who changes it must be a SharePoint site admin. Ordinary members, including members with Edit permission, and visitors can work in the sites but cannot change the container label. The closest wrong option is E: Edit permission sounds powerful, but it covers content, not the label on the site itself.
Question 3 (Implement data loss prevention and retention)
A retailer wants one DLP policy for both SharePoint sites and Teams chat and channel messages, to keep the policy count low. In SharePoint, documents must be detected by their sensitivity label. Teams messages only need detection by sensitive info type. What should you do?
- A. Keep one policy and add the sensitivity label condition in a second rule
- B. Keep one policy and detect only by sensitive info types for both locations
- C. Create one policy for SharePoint and a separate policy for Teams
- D. Keep one policy and set a default sensitivity label on the SharePoint library
Show the answer and explanation
Correct answer: C. When one policy covers several locations, a condition type that one location does not support rules it out for the whole policy. Teams chat and channel messages cannot be detected by sensitivity label, so a combined policy would be limited to sensitive info types. Two policies let SharePoint use the label condition. A second rule does not change what the combined locations support, option B drops the label requirement, and a default library label has nothing to do with policy conditions.
Question 4 (Manage risks, alerts, and activities)
In Adaptive Protection, Litware customizes the Elevated risk level. The level uses two conditions based on alerts: one for alerts generated for a user and one for alerts confirmed for a user. A user now has a generated alert of the configured severity, but no alert has been confirmed. What happens?
- A. The user is assigned the Elevated risk level right away
- B. The user is assigned the Elevated level only after an analyst confirms an alert
- C. The user stays unassigned until the risk levels are reset
- D. The user is assigned the Moderate level until both conditions are met
Show the answer and explanation
Correct answer: A. Conditions based on alerts generated or confirmed for a user are not combined: the level is assigned as soon as any one of them is met. A generated alert of the configured severity is enough. This differs from conditions based on specific user activity, where all conditions must be met. Option B treats the two conditions as additive, which is the closest wrong idea. Moderate is a separately defined level and not a fallback, and resetting levels does not control assignment.
Question 5 (Manage risks, alerts, and activities)
An analyst builds an audit search she will reuse every week. In the field for operation names, she types the words File downloaded and File accessed, separated by a comma, instead of choosing from the friendly names list. The search runs and returns no results, although users downloaded files in that period. What is the most likely cause?
- A. The Users field was left empty
- B. The field accepts only one operation per search
- C. The record types filter must also be set to SharePoint
- D. The text does not match the exact operation names
Show the answer and explanation
Correct answer: D. This field expects exact operation names, separated by commas, such as FileDownloaded and FileAccessed. Descriptive text with spaces does not match anything, so the search returns nothing. The friendly names list is the alternative that groups activities under readable names. Option B is the closest wrong option, but commas already allow several operations. An empty Users field means all users, and the record types filter is optional.
What to do with your result
Count only the questions you got right for the right reason. If you missed a domain 1 question, spend time on classification and labels. If you missed Question 3 or 4, practice reading which condition decides the answer. Missing Question 5 usually means too little time in the portal.
More guides for SC-401
- SC-401 Exam Format, Scoring and Retakes
- SC-401 Study Plan: 4-Week and 8-Week
- Is SC-401 Hard? An Honest Difficulty Check
- SC-401 Prerequisites and Skills Self-Check
- SC-401 Renewal and Retakes Explained
- Is SC-401 Worth It? An Honest Look
- SC-401 Cheat Sheet: Key Facts to Review
- SC-200 vs SC-401: Which First?
Next step
For the topic behind each question, go back to the domains explained page. When you want more, the SC-401 practice exams have 500 original questions in five sets, with an explanation for every answer option.