Exam Code: SC-401
Exam Name: Administering Information Security in Microsoft 365
Price: $68.00 $58.88
Exam Questions: 264 Q&As
Last Updated: 2026-08-23
Prepare for Exam SC-401 with scenario-based practice covering information protection, data loss prevention, retention, insider risk, alerts, and security controls for data used by AI services.
The Microsoft Certified: Information Security Administrator Associate certification validates your ability to protect sensitive data across Microsoft 365 by using Microsoft Purview and related security services.
An Information Security Administrator plans and implements controls for sensitive data in Microsoft 365 collaboration environments. The role protects information from internal and external threats, reduces exposure through DLP and retention controls, manages insider risk, and investigates information security alerts and activities.
The current exam also expects you to protect data used by AI services. This includes Microsoft Purview controls, Microsoft 365 workload settings, and Data Security Posture Management for AI. Questions often ask which control fits a precise data state, location, user action, or investigation requirement.
Be familiar with Microsoft 365 services, PowerShell, Microsoft Entra, the Microsoft Defender portal, and Microsoft Defender for Cloud Apps. You should also understand how administrators, workload owners, security teams, and governance stakeholders divide responsibility for data controls.
Start with the protected object and required outcome. A label classifies and can protect content, DLP governs risky use or sharing, retention controls preservation and deletion, and insider risk correlates risky user activity. Selecting the right feature family usually removes two distractors before product details matter.
The following outline reflects the Microsoft study guide effective July 28, 2026. Each domain accounts for 30% to 35% of the exam, so none can be treated as a minor topic.
Translate data requirements into built-in or custom sensitive info types, document fingerprints, exact data match types, and trainable classifiers. Monitor classification through Data Explorer and Content Explorer, and configure OCR support where image-based content must be inspected.
Create, publish, and manage sensitivity labels for files, emails, Teams, Microsoft 365 Groups, SharePoint, and Power BI. Review encryption permissions, content markings, auto-labeling, container settings, the Purview Information Protection client and scanner, and standard or Advanced Message Encryption.
Design DLP policies, roles, rules, locations, exceptions, actions, and precedence. Include Adaptive Protection, Microsoft Defender for Cloud Apps file policies, Endpoint DLP requirements and settings, advanced device rules, just-in-time protection, and endpoint activity monitoring.
Plan retention and disposition with retention labels, publishing and auto-apply policies, adaptive policy scopes, retention policies, Policy Lookup, precedence rules, and recovery of retained Microsoft 365 content.
Implement Insider Risk Management roles, connectors, indicators, templates, policies, forensic evidence settings, Adaptive Protection integration, alerts, cases, and notices. Investigate with Audit, Activity Explorer, Purview alerts, Microsoft Defender XDR, Defender for Cloud Apps, and eDiscovery.
Protect data used by AI services with Microsoft Purview and Microsoft 365 workload controls. Configure prerequisites, permissions, policies, and monitoring for Data Security Posture Management (DSPM) for AI.
Label permission versus label visibility: publishing makes a label available; usage rights determine what a user or service can do with encrypted content. DLP versus retention: DLP responds to risky activity, while retention preserves or deletes content over time. Classifier choice: EDM matches structured records, document fingerprinting matches forms, and trainable classifiers identify content by learned context.
Days 1 and 2: sensitive info types, classifiers, labels, encryption, SharePoint, Exchange, and the scanner. Days 3 and 4: DLP design, Endpoint DLP, rule precedence, Adaptive Protection, retention labels, and policy precedence. Days 5 and 6: insider risk, Audit, alerts, eDiscovery, Defender integration, and DSPM for AI. Day 7: complete a timed mixed set and review every incorrect option.
Look for the exact control boundary in each scenario. These are independent practice questions, not official Microsoft exam questions.
You have a Microsoft 365 E5 subscription that contains a Microsoft Teams channel named Channel1. Channel1 contains research and development documents. You plan to implement Microsoft 365 Copilot.
You need to prevent file contents stored in Channel1 from being included in Copilot answers and shown to unauthorized users. What should you use?
Correct answer: D
Explanation: Sensitivity labels classify and protect files. Encryption and usage rights applied by the label remain relevant when Microsoft 365 Copilot accesses grounded content, so unauthorized users cannot gain rights merely through a generated response.
Security checkpoint: Copilot respects the user's existing access and information protection controls. Confirm label publishing, encryption permissions, SharePoint support, and site or file access rather than treating Copilot as a separate authorization system.
Common mistake: Choosing DLP because the scenario describes data leakage. DLP controls risky actions and sharing patterns; the requirement is persistent protection of the source files and their contents.
Why the other options are wrong: B detects risky user behavior rather than applying file protection. C restricts communication and collaboration between defined groups but is not the primary control for encrypting these documents. A does not provide the persistent access rights requested.
You have a Microsoft 365 E5 subscription. You need to create a sensitivity label named Label1. Users must be able to use Microsoft 365 Copilot to summarize files that have Label1 applied. Which permission should you select for Label1?
Correct answer: B
Explanation: Copilot needs the EXTRACT usage right to copy or extract protected content for summarization. A user may be able to open a document without having the permission required for Copilot to process its contents.
Security checkpoint: Encryption permissions are granular. Test the specific action required by the workload instead of assuming VIEW or EDIT implies every downstream operation.
Common mistake: Selecting VIEW because summarization begins by reading the file. Viewing the document and extracting its protected content are different rights.
Why the other options are wrong: A allows exporting content, which is broader than the stated need. C permits editing but does not supply the required extraction right. D permits viewing only.
You have a Microsoft 365 E5 subscription. You need to enable support for sensitivity labels in Microsoft SharePoint Online. What should you use?
Correct answer: A
Explanation: The Microsoft Purview portal is the administration location for enabling and managing sensitivity-label support for Office files in SharePoint and OneDrive, along with the related information protection configuration.
Security checkpoint: Distinguish tenant content-protection settings from site administration. A SharePoint site holds the content, but Microsoft Purview owns the sensitivity-label policy and protection experience.
Common mistake: Choosing the SharePoint admin center because SharePoint stores the files. Storage location does not determine which portal manages the classification control.
Why the other options are wrong: B manages identity and access. C manages SharePoint sites and service settings but is not the requested information protection control plane. D provides broad Microsoft 365 administration rather than the Purview label setting.
You have a Microsoft 365 E5 subscription. You need to ensure that encrypted email messages sent to an external recipient can be revoked or will expire within seven days. What should you configure first?
Correct answer: A
Explanation: Microsoft Purview Advanced Message Encryption uses a custom branding template to configure controls such as an external recipient expiration period. The template establishes the protected-message experience and expiration behavior before a rule applies it.
Security checkpoint: Watch for the word "first." A mail flow rule may later select messages and apply the template, but the required expiration configuration must already exist in the custom branding template.
Common mistake: Choosing B because mail flow rules automate encryption. Automation is not the same as defining the seven-day expiration behavior.
Why the other options are wrong: B can apply protection based on conditions but does not define the template first. C can encrypt messages but is not the first configuration for this Advanced Message Encryption expiration requirement. D governs access conditions and does not configure message expiration.
A SharePoint Online document library contains more than 1,000 English-language documents, including job applicant resumes. You plan to apply a sensitivity label automatically only to documents identified as resumes that contain work experience, education, and accomplishments.
You need to identify and categorize the resumes while minimizing administrative effort. What should the solution include?
Correct answer: A
Explanation: A trainable classifier identifies documents by their overall content and context. Resume recognition depends on a combination of sections and meaning, not one exact value or a short keyword list.
Security checkpoint: Choose a classifier based on the shape of the evidence. Use EDM for exact structured records, document fingerprinting for standard forms, sensitive info types for recognizable patterns, and trainable classifiers for content categories such as resumes.
Common mistake: Selecting B because resumes often contain predictable headings. Keywords such as "education" and "experience" can also appear in many documents, which increases false positives and ongoing tuning effort.
Why the other options are wrong: B lacks enough contextual understanding. C detects values that satisfy defined logic rather than a document category. D compares content with hashed values from a structured data source and is not suited to recognizing resume structure.
Content is reviewed when Microsoft updates the SC-401 study guide, Microsoft Purview features, or related Microsoft 365 and Defender guidance. Check the product page for its latest update date.
Yes. The five examples above show Microsoft 365 scenarios with explanations, security checkpoints, common mistakes, and analysis of the incorrect options.
No. They are independent exam-preparation material. CertQuestionsBank is not affiliated with or endorsed by Microsoft.
A downloaded PDF can be opened offline and printed with a compatible PDF reader. Confirm the formats included in the current package before checkout.
Review the current product description for the exact package contents. The samples above demonstrate the teaching format used on this page, including distractor analysis.
The ICE simulator offers installers for iOS, Android, macOS, and Windows. Check the current version and device requirements before installation.
Eligible purchases include free updates for three months. Review the current checkout terms for the exact coverage period and delivery method.
Refund requests are reviewed individually. A request may be considered within 7 days when most material has not been used, or for duplicate purchases, unresolved access issues, or another clearly documented problem.
Review classification, labels, encryption, DLP, retention, insider risk, investigations, alerts, and data protection for AI services.
This page is for educational and exam-preparation purposes only. CertQuestionsBank is independently operated and is not affiliated with, endorsed by, or authorized by Microsoft. The sample questions are independent practice material and do not reproduce confidential certification content. Candidates should consult the official Microsoft certification page, SC-401 study guide, and product documentation for current information. Microsoft, Microsoft 365, Microsoft Purview, product names, certification names, exam codes, and other third-party trademarks belong to their respective owners.
Your email address will not be published. Required fields are marked *
All third-party certification names, exam codes, and trademarks belong to their respective owners. Certquestionsbank is independently operated and is not affiliated with, endorsed by, or authorized by any certification provider.
