SC-401 Practice Tests: Information Security Administrator
500 questions on sensitivity labels, DLP and Endpoint DLP, retention, Insider Risk Management and data security for AI
Are you ready for SC-401, or do you only recognise the terms? Reading about Microsoft Purview is one thing; choosing between exact data match and document fingerprinting, or between a retention label and a retention policy, under time pressure is another. These practice tests show you exactly where you stand.
This practice set contains 500 original questions in five full-length tests of 100 questions each. They are written against the skills measured as of October 28, 2026 for exam SC-401: Administering Information Security in Microsoft 365, and follow the official weighting of its three domains: information protection, data loss prevention and retention, and risks, alerts and activities, including the newer area of protecting data used by AI services.
SC-401 replaced SC-400 in 2025. The scope moved: DSPM for AI, DLP for Microsoft 365 Copilot, Adaptive Protection, just-in-time protection for Endpoint DLP, adaptive scopes and Purview alerts in Microsoft Defender XDR are in; communication compliance, information barriers and privacy management are out. Older SC-400 material spends time on topics you will not see and misses topics you will.
The five tests build up step by step:
– Test 1, Groundwork: one concept per question, short stems.
- Test 2, In Practice: short scenarios that separate features which are easily confused.
- Test 3, Trade-offs: two answers look right and one constraint decides.
- Test 4, Under the Hood: roles, settings, cmdlets, defaults and limits.
- Test 5, Exam Day: long multi-constraint scenarios at the pace of the real exam.
Every answer option has its own explanation, so you learn why a wrong option is wrong and what it actually does. Each question also has an overall explanation that ends with a link to the Microsoft Learn page it is based on.
PrepKiwi reports your score per SC-401 domain after every attempt, so you can target your weakest area. The passing score is 80% for tests 1 to 4 and 85% for test 5, deliberately above the real exam, so a pass here means a margin rather than luck.
What this practice set is not: it is not a video course, and it does not contain real exam questions. It is a practice and feedback tool to use alongside the free Microsoft Learn training for SC-401 and hands-on time in a Microsoft 365 tenant.
Groundwork: Purview Building Blocks
100 questions · 165 minutes · pass mark 80%
Groundwork is your baseline. These 100 questions check the core building blocks of SC-401 one concept at a time: sensitive information types, sensitivity labels, the Information Protection client and scanner, Message Encryption, DLP, Endpoint DLP, retention, Insider Risk Management, Audit, eDiscovery and data security for AI. Stems are short and direct, so you find out quickly what you know and what you only recognise. The questions follow the three SC-401 domains in the official weighting, and every answer option has its own explanation. You get 165 minutes, which leaves plenty of time to think. The passing score is 80%, higher than you need on the real exam, because a practice test taken at home is easier than a test centre and a clear margin tells you more than a narrow pass. Take this test cold, before you study further, and use the domain report to decide where to start.
In Practice: Picking the Right Purview Control
100 questions · 165 minutes · pass mark 80%
In Practice moves from definitions to short workplace scenarios. Each of the 100 questions describes a concrete need and asks which Microsoft Purview feature, setting or role meets it. The focus is on neighbours that are easy to mix up: EDM versus document fingerprinting, sensitivity labels versus retention labels, Restricted Content Discovery versus Restricted Access Control, Activity explorer versus Audit, auto-labeling versus default labels, and the different DLP locations and actions. Every answer option explains why it does or does not fit, so the distinction sticks. Time limit: 165 minutes. Passing score: 80%. Review the domain report afterwards and revisit the areas where you confused two similar features.
Trade-offs: When Two Answers Look Right
100 questions · 170 minutes · pass mark 80%
Trade-offs is where the SC-401 exam starts to feel real. In these 100 questions two answers often look reasonable, and one stated condition decides: on-premises files versus cloud locations, a device versus a service, auditing versus blocking, a retention label versus a retention policy, a user notice versus an admin alert. Read every constraint in the stem before you answer. The explanations show which detail rules each option in or out, which is exactly the skill the real exam rewards. Time limit: 170 minutes for longer scenario stems. Passing score: 80%. If you score lower here than on the first two tests, that is normal; use the per-option explanations to see which constraint you skipped.
Under the Hood: Settings, Roles and Limits
100 questions · 135 minutes · pass mark 80%
Under the Hood tests the administrator detail behind the features: role groups and permissions, policy settings and their defaults, PowerShell cmdlets, the order of configuration steps, time windows and service limits for Purview, Endpoint DLP, retention, Insider Risk Management, Audit and eDiscovery. Stems are shorter again, but the options sit close together, so recognising a feature name is no longer enough. You need to know how it is configured. Time limit: 135 minutes. Passing score: 80%. The overall explanation for each question ends with a link to the Microsoft Learn page it is based on, so you can check the exact setting yourself.
Exam Day: Full-Length Simulation
100 questions · 155 minutes · pass mark 85%
Exam Day is the readiness check. The 100 questions have the longest stems in this practice set, several constraints per question, and all three SC-401 domains mixed together, as on the real exam. Take it in one uninterrupted sitting, without notes, once you have worked through tests 1 to 4. The clock is tighter: 155 minutes for 100 questions, about the same pace per question as the real exam. The passing score is 85%, above the other tests and above what the real exam requires. That is deliberate: a result above 85% here, under time pressure, is a much stronger signal of readiness than a narrow pass. If you fall short, go back to your weakest domain, reread the explanations and retake the test after a few days.
What you will practice
- Test your readiness for SC-401 with 500 questions across all three domains of the October 28, 2026 skills outline.
- Choose the right Purview control: SITs, EDM, fingerprinting, sensitivity labels, DLP, Endpoint DLP, retention and Insider Risk Management.
- Learn from an explanation for every answer option plus an overall explanation that links to the Microsoft Learn source.
- Build up in five steps, from core concepts to a timed full-length simulation that mirrors the pace of the real exam.
- Sharpen your investigation skills with Audit, Activity explorer, eDiscovery and DLP alerts in Purview and Defender XDR.
- Protect data used by AI: DSPM for AI, DLP for Microsoft 365 Copilot and SharePoint controls against oversharing.
Exam domains covered
Who is this for
This practice set is for Microsoft 365 administrators, security and compliance engineers, and IT professionals who are moving into information protection and data security, and who plan to take exam SC-401: Administering Information Security in Microsoft 365. It also suits students and career switchers who have worked through the Microsoft Learn paths and want to know whether they are ready, and consultants or data governance specialists who need a solid grasp of Microsoft Purview. If you prepared for the retired SC-400 (Microsoft Information Protection Administrator), note that SC-401 replaced it in 2025: protecting data used by AI services, Adaptive Protection, just-in-time protection for Endpoint DLP, adaptive scopes and responding to Purview alerts in Microsoft Defender XDR are now in scope, while communication compliance, information barriers and privacy management are not. This is a set of practice exams with detailed explanations. It checks and deepens your knowledge; it does not replace hands-on training or the official learning paths.
Requirements
- Basic familiarity with Microsoft 365 administration (Exchange Online, SharePoint, OneDrive, Teams) and the Microsoft Purview portal. Some PowerShell and Microsoft Entra ID knowledge helps, as the exam profile assumes it.
- No paid software needed. A free Microsoft 365 developer or trial tenant is useful for trying settings, but not required.
- These are practice tests, not a video course. Use them alongside the free Microsoft Learn training for SC-401, not instead of it.
Free exam guide
Not sure what to expect? Read how the exam is built, what it covers and how to prepare.