SC-401 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Sensitivity label policy

Defines which users and groups can see and apply a published set of labels, and sets the default label, mandatory labeling, and help link.

Client-side auto-labeling

Applies or recommends labels inside Office apps as content is created or edited, evaluating sensitive information types on the user's device against the policy's rules.

Service-side auto-labeling

Scans data at rest in SharePoint, OneDrive, and Exchange and labels matching items; run it in simulation mode first, then enable the policy to enforce labels.

Double Key Encryption

Protects content with two keys, one held by Microsoft and one by the customer in an on-premises HSM, so no single party can decrypt the protected content.

Exact data matching

Sensitive information type built from a hashed table of exact values, giving high-confidence detection of data such as employee IDs or account numbers.

Document fingerprinting

Converts the structure of a template form into a custom sensitive information type so that filled-in copies of that form can be detected.

Trainable classifier

Machine learning model that recognizes content by example rather than by pattern; pre-trained versions exist and custom ones are trained with positive samples.

Content marking

Label setting that adds a header, footer, or watermark to documents and emails when the label is applied; the marking text can include variables.

Encryption usage rights

Permissions granted by a label's encryption, such as view, edit, print, copy, or export, that determine what a recipient can do with protected content.

Container site label

Sensitivity label applied to a Teams team, SharePoint site, or Microsoft 365 group that controls privacy plus external sharing and guest access settings.

Content explorer

Purview tool showing the current state of items that carry a specific sensitivity label or match a sensitive information type or trainable classifier.

DLP policy locations

The workloads a data loss prevention policy protects: Exchange, SharePoint, OneDrive, Teams chat and channel messages, endpoint devices, cloud apps, and on-premises repositories.

Policy tip

Configurable message shown in the client app to users whose content matches a DLP rule, explaining the issue and offering an override when allowed.

Adaptive Protection condition

DLP rule condition that uses the user's insider risk level (minor, moderate, elevated), so higher-risk users receive stricter enforcement from the same policy.

Endpoint DLP

Extends DLP to onboarded Windows and macOS devices, restricting activities such as copying to USB, printing, uploading to cloud services, and using Remote Desktop.

Retention policy

Location-scoped retention applied to all content in Exchange, SharePoint, OneDrive, Teams, or Viva Engage; it contains rules with retain and delete settings.

Retention label

Item-level retention applied manually or automatically, supporting retain-and-delete, retain-only, or delete-only, and optionally marking the item as a record.

Event-based retention

Retention whose period starts when a specified event occurs, such as an employee leaving the organization, rather than at creation or last modification of the item.

Disposition review

Workflow that routes items at the end of retention to reviewers who can approve disposal, extend the retention period, or relabel the item before deletion.

Regulatory record label

Record label that blocks changes and deletion of content, including by administrators, and can be configured to prevent removal or relabeling.

Auto-apply retention label

Policy that applies a retention label to items matching a sensitive information type, trainable classifier, keyword query, or cloud attachment condition.

Retention precedence rules

Retention wins over deletion; the longest retention period wins; an explicit label beats an implicit policy; among deletion periods the shortest wins.

Insider Risk Management policy

Built from a template such as data theft by departing users; you choose indicators, thresholds, users in scope, and whether alerts are anonymized.

Forensic evidence capture

Optional IRM setting that records a short clip of user activity for a triggering indicator and stores it with the case for investigator review.

Audit Premium

Add-on audit capability with ten-year retention, high-value events, and intelligent insights; it requires per-user licensing and enables longer audit retention policies.

Audit retention policy

Policy that sets how long audit records are kept, by record type or activity, from 180 days up to ten years depending on licensing in the tenant.

eDiscovery hold

Preserves Exchange, SharePoint, OneDrive, and Teams content for a case, either for whole locations or query-based, even if users delete the items.

Communication compliance

Monitors Teams, Exchange, and other communications with classifiers and keyword lists, routing flagged messages to reviewers who can remediate and escalate.

Alert triage in Purview

DLP, IRM, and other alerts are reviewed in the Purview portal or Defender XDR; status, severity, aggregation, and assignment drive the investigation workflow.

Activity explorer

Purview tool that shows up to thirty days of label activities such as applied, changed, removed, and file accessed, plus DLP rule matches.

IRM risk levels

Scores derived from indicator hits and thresholds that classify users as minor, moderate, or elevated risk, and can feed Adaptive Protection policies.

Anonymization in IRM

Policy setting that hides user names in alerts and cases; only users holding the required role can reveal the identity behind an alert.