I85PREP
⌘ K
SC-401 study materials
SC-401 study resources

SC-401 practice questions

One question at a time. Build your SC-401 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Implement information protection

What is the primary effect of applying a sensitivity label to a document in Microsoft Purview?

  1. It converts the document into a read-only PDF file.
  2. It applies the label's protection and marking settings. Correct answer.
  3. It moves the document to a Purview retention archive.
  4. It removes all existing metadata from the document.

Explanation

A sensitivity label is metadata that can trigger configured protections, such as encryption and content marking, whenever the content is used or shared. It does not change the file type, relocate the item to an archive, or strip metadata.

Question 2Implement information protection

What must an administrator create to make published sensitivity labels available to users in an organization?

  1. A sensitivity label policy Correct answer.
  2. A retention label policy
  3. An auto-labeling simulation
  4. A data loss prevention policy

Explanation

Sensitivity label policies publish labels to selected users or groups and define settings such as default label and mandatory labeling. Retention, DLP, and simulations do not publish sensitivity labels for manual use.

Question 3Implement information protection

Which sensitivity label setting determines the label that is selected automatically when a user creates new content?

  1. Label priority
  2. Content marking
  3. Justification requirement
  4. Default label Correct answer.

Explanation

A default label is automatically assigned to new content when the label policy applies, although users may change it if policy permits. Label priority orders labels, content marking adds visual markings, and justification applies to label changes.

Question 4Implement information protection

Which setting requires users to assign a sensitivity label before they can save a document or send an email?

  1. Label priority
  2. Content marking
  3. Label encryption
  4. Mandatory labeling Correct answer.

Explanation

Mandatory labeling prevents users from saving files or sending messages without choosing a label when the policy applies. Encryption and content marking are label actions, while priority orders labels.

Question 5Implement information protection

Which sensitivity label feature can insert a header, footer, or watermark into labeled content?

  1. Auto-labeling
  2. Content marking Correct answer.
  3. Label priority
  4. Encryption

Explanation

Content marking configures visual markings such as headers, footers, and watermarks that are added to labeled documents and emails. Auto-labeling assigns labels, priority orders labels, and encryption restricts access.

Question 6Implement information protection

When a sensitivity label applies encryption with user-defined permissions, what can the label restrict?

  1. Only network access to the file share
  2. Only the user's ability to sign in to Microsoft 365
  3. Actions such as printing, copying, and editing Correct answer.
  4. Only the file name and extension

Explanation

User-defined encryption permissions grant or deny usage rights, including printing, copying, editing, and forwarding. They do not rename files, control Microsoft 365 sign-in, or limit share-level network access.

Question 7Implement information protection

What does client-side auto-labeling do in Microsoft Purview?

  1. It labels content stored only in third-party cloud services.
  2. It replaces all manually applied labels at midnight.
  3. It labels content as users create or edit it in Office apps. Correct answer.
  4. It deletes unlabeled content after a retention period.

Explanation

Client-side auto-labeling runs in supported Office apps and can recommend or automatically apply a label while content is being created or edited. It does not target only third-party clouds, overwrite labels on a schedule, or delete content.

Question 8Implement information protection

What is a sensitivity label applied to a Microsoft Teams team or SharePoint site called?

  1. A sensitive information type
  2. A retention label
  3. A container label Correct answer.
  4. A document fingerprint

Explanation

A container label is a sensitivity label applied to a site, team, or group to protect the container and optionally set defaults for content inside it. Retention labels, fingerprints, and sensitive information types are different Purview constructs.

Question 9Implement information protection

An administrator needs a sensitivity label policy to apply only to users in the Finance department. What should the administrator configure?

  1. The policy's scoped users Correct answer.
  2. The policy's retention period
  3. The label's encryption template
  4. The label's content marking

Explanation

A sensitivity label policy is published to selected users or groups, so scoping the policy to the Finance group limits who receives the labels. Content marking and encryption are label settings, and retention periods belong to retention policies.

Question 10Implement information protection

A sensitivity label is configured with an encryption template. What is the main advantage of using a template rather than user-defined permissions?

  1. It lets each user choose a different set of rights at send time.
  2. It automatically converts email to plain text.
  3. It removes the need to publish the label to users.
  4. It applies a consistent predefined set of usage rights. Correct answer.

Explanation

An encryption template defines a reusable set of rights and users so labeled content receives consistent protection without each user choosing permissions. The label still must be published, and templates do not convert messages to plain text.

Question 11Implement information protection

Which condition must be met for multiple users to co-author an encrypted document that uses sensitivity label encryption?

  1. Encryption must be removed before sharing.
  2. The document must be stored on a local USB drive for sharing.
  3. The label grants sufficient rights and supports co-authoring. Correct answer.
  4. The document must be converted to PDF.

Explanation

Co-authoring encrypted content requires that the protection grants each collaborator the necessary usage rights and that the label configuration supports co-authoring. Removing encryption or converting to PDF defeats the protection and is not required.

Question 12Implement information protection

Where does service-side auto-labeling evaluate content at rest?

  1. Only in locally installed Office apps
  2. Only in Microsoft Teams chat messages
  3. In SharePoint, OneDrive, and Exchange Correct answer.
  4. Only in Microsoft Defender for Endpoint alerts

Explanation

Service-side auto-labeling scans content at rest in supported Microsoft 365 locations such as SharePoint, OneDrive, and Exchange. Client-side labeling handles content in Office apps, and Defender alerts are not a labeling workload.

Question 13Implement information protection

What is required to use a trainable classifier in Microsoft Purview?

  1. Converting all content to a single file format
  2. Assigning every user an E5 license
  3. Creating a transport rule in Exchange Online
  4. Providing sample content to train the classifier Correct answer.

Explanation

A trainable classifier must be trained with representative positive and negative samples before it can identify that category of content. Transport rules, universal E5 licensing, and file-format conversion are not training requirements.

Question 14Implement information protection

What does Exact Data Match (EDM) use to identify sensitive information?

  1. A regular expression for detecting credit card numbers
  2. A list of generic keywords
  3. A hashed sensitive information type built from a data table Correct answer.
  4. A machine-learning model trained only on public websites

Explanation

EDM ingests a structured table of sensitive values, hashes the data, and creates a sensitive information type that matches exact values with low false positives. It is not a keyword list, a public-web model, or a generic regular expression.

Question 15Implement information protection

What is document fingerprinting used for?

  1. Tracking document print jobs
  2. Blocking all outbound email attachments
  3. Encrypting documents with a customer-managed key
  4. Detecting sensitive content by using a template's structure Correct answer.

Explanation

Document fingerprinting converts a template document into a sensitive information type so DLP can detect content derived from that template's structure. It does not manage encryption keys, track printing, or block every attachment.

Question 16Implement information protection

An administrator wants a DLP policy to protect content that has a specific sensitivity label. Which DLP condition should they use?

  1. Content contains a sensitive information type
  2. Content has the specified sensitivity label Correct answer.
  3. Content is generated by a trainable classifier
  4. Content is shared with external users

Explanation

DLP rules can use a sensitivity label as a condition so the rule acts on content carrying that label. Sensitive information types, external sharing, and classifiers are different conditions.

Question 17Implement information protection

Which setting can require users to provide a reason when they remove or downgrade a sensitivity label?

  1. Content marking setting
  2. Justification setting Correct answer.
  3. Label priority setting
  4. Default label setting

Explanation

The justification setting prompts users to enter a business reason when they lower or remove a label, creating an audit trail. Default labels choose an initial label, content marking adds visual elements, and priority orders labels.

Question 18Implement information protection

What is the purpose of running an auto-labeling policy in simulation mode?

  1. To delete content that matches the policy
  2. To publish labels to users for manual application
  3. To immediately apply labels to all matching content
  4. To preview labeling results without applying labels Correct answer.

Explanation

Simulation mode lets administrators review which items would be labeled and tune conditions before enabling the policy. It does not apply labels, delete content, or publish labels for manual use.

Question 19Implement information protection

Which statement describes label inheritance for new documents created in a labeled SharePoint site?

  1. New documents never receive a label from the site.
  2. New documents always override the site label with an unlabeled state.
  3. New documents receive the site label only after one year.
  4. New documents can inherit the site label by default. Correct answer.

Explanation

A container label on a SharePoint site can set a default sensitivity label for new documents created in that site. Inheritance is a configuration choice, not a one-year delay, and documents are not forced to be unlabeled.

Question 20Implement information protection

How can a sensitivity label protect an email message that is sent outside the organization?

  1. By deleting the message after it is read
  2. By applying a retention label to the mailbox
  3. By applying encryption and usage rights that persist Correct answer.
  4. By converting the message to a Teams channel post

Explanation

Sensitivity label encryption travels with the message and enforces usage restrictions for recipients, including external recipients. Deletion, Teams conversion, and mailbox retention do not provide persistent protection for the message content.

Question 21Implement information protection

What distinguishes Double Key Encryption from standard sensitivity label encryption?

  1. It uses only a single key managed by Microsoft.
  2. It uses two keys, with one kept outside Microsoft's control. Correct answer.
  3. It stores all encrypted content in plain text for indexing.
  4. It disables encryption when a user opens the file offline.

Explanation

Double Key Encryption protects content with two keys, and the customer can hold one key outside Microsoft's environment so Microsoft cannot decrypt content alone. Standard label encryption does not require that split-key model.

Question 22Implement information protection

What is the role of Customer Key in Microsoft 365 information protection?

  1. It lets the organization control root keys for Microsoft 365 data. Correct answer.
  2. It encrypts only email attachments sent to external recipients.
  3. It replaces sensitivity labels with retention labels.
  4. It automatically classifies documents by using trainable classifiers.

Explanation

Customer Key lets an organization provide and control root encryption keys in Azure Key Vault for Microsoft 365 data at rest. It does not replace labels, target only external attachments, or perform classification.

Question 23Implement information protection

An organization wants recipients without Microsoft 365 accounts to read encrypted email. Which capability supports this?

  1. A retention policy that deletes the message after reading
  2. Message Encryption with a one-time passcode Correct answer.
  3. A sensitivity label that removes all recipients
  4. A DLP policy that blocks all external recipients

Explanation

Microsoft Purview Message Encryption can deliver encrypted mail to external recipients through a one-time passcode or federated identity experience. Retention deletion, blocking recipients, and removing recipients do not enable secure reading.

Question 24Implement information protection

When a user opens a file protected by sensitivity label encryption while offline, what typically allows the application to enforce the label's usage rights?

  1. The mailbox retention tag applied to the user
  2. A public folder share
  3. The file's original file name
  4. A cached license granting the allowed rights Correct answer.

Explanation

Rights management clients can use a cached use license, subject to its validity period, to enforce permitted actions while offline. File names, public folders, and mailbox retention tags do not grant usage rights.

Question 25Implement information protection

How does Adaptive Protection enhance DLP in Microsoft Purview?

  1. It disables DLP for users who have never triggered an alert.
  2. It encrypts all files with a single organization-wide password.
  3. It replaces sensitivity labels with retention labels.
  4. It tunes DLP controls to the user's insider risk level. Correct answer.

Explanation

Adaptive Protection uses insider risk signals to dynamically adjust DLP controls, such as blocking or auditing, for users at different risk levels. It does not use a shared password, replace labels, or simply disable DLP for low-risk users.

Question 26Implement information protection

An administrator creates multiple sensitivity labels in the Microsoft Purview portal. How is the relative priority of the labels determined?

  1. By the alphabetical order of the label names.
  2. By the date on which each label was created, with the oldest label ranked highest.
  3. By the number of label policies that publish each label.
  4. By the order of the labels in the list, with the label at the top ranked highest. Correct answer.

Explanation

Sensitivity labels are held in an ordered list, and the label at the top of that list has the highest priority (the lowest order number). Priority decides which label takes precedence when labels from different sources meet, such as a default label versus a label suggested by a policy.

Question 27Implement information protection

Which content marking element can a sensitivity label add to email messages?

  1. A page number
  2. A barcode
  3. A watermark
  4. A header Correct answer.

Explanation

Content marking supports headers and footers that are stamped into Word documents, Excel workbooks, PowerPoint presentations, and email messages. Watermarks are applied only to documents and never to email.

Question 28Implement information protection

Which sensitivity label policy setting causes every new Word, Excel, and PowerPoint file to start with a specified label?

  1. Require users to apply a label to their emails and documents
  2. Users must provide justification to remove a label
  3. Default label for documents Correct answer.
  4. Default label for emails

Explanation

A label policy has separate default label settings for documents and for emails. The document default pre-selects a label on new files, and users can still change it in the application unless other controls prevent that.

Question 29Implement information protection

What does publishing a sensitivity label policy to a set of users accomplish?

  1. It prevents those users from changing a label once it is applied.
  2. It applies the selected labels to all existing files in those users' OneDrive accounts.
  3. It makes the selected labels available to those users in supported applications. Correct answer.
  4. It encrypts every email those users send.

Explanation

A label policy publishes, or distributes, chosen labels to chosen users or groups. Publishing only makes labels selectable in Office apps and other supported clients; it does not automatically label existing content or lock labels in place.

Question 30Implement information protection

A sensitivity label named Confidential has sublabels named Legal and Finance. What is the purpose of these sublabels?

  1. To offer more granular choices within the Confidential category. Correct answer.
  2. To prevent the parent label from being used on emails.
  3. To convert Confidential into a retention label.
  4. To publish the parent label to two different groups of users.

Explanation

Sublabels, or child labels, let a parent label act as a category with more specific levels beneath it. Users then select a precise classification such as Confidential\Finance instead of a single generic label.

Question 31Implement information protection

Which property of a sensitive information type determines how much corroborating evidence is needed before a match is considered reliable?

  1. Instance count
  2. Confidence level Correct answer.
  3. Recommended confidence
  4. Scope

Explanation

The confidence level expresses how much evidence, such as supporting keywords or proximity between elements, is required for a match to count. Higher confidence levels reduce false positives because the pattern must be corroborated by other elements.

Question 32Implement information protection

An administrator must be able to create and publish sensitivity labels but should not receive other compliance permissions. Which role group should be assigned?

  1. Information Protection Admin Correct answer.
  2. Records Management
  3. eDiscovery Manager
  4. Global Reader

Explanation

The Information Protection Admin role group is scoped to creating, publishing, and managing sensitivity labels and label policies. It does not grant case management, retention management, or tenant-wide read-only access.

Question 33Implement information protection

A user who owns a document removes a sensitivity label that applied encryption. What happens to the encryption?

  1. The document is moved to the SharePoint recycle bin.
  2. The document becomes read-only in all applications.
  3. The encryption is removed together with the label. Correct answer.
  4. The document stays encrypted until the tenant administrator removes the template.

Explanation

Protection is tied to the label on the item, so removing the label removes the associated encryption, provided the user holds usage rights that allow removing protection. Owners and users with Full Control normally have that right.

Question 34Implement information protection

A user protects an email by using the Do Not Forward template. Which actions can the recipients perform?

  1. Add additional recipients to the existing thread.
  2. Read the message and reply to the sender, but not forward, print, or copy it. Correct answer.
  3. Forward the message to colleagues inside the organization.
  4. Edit the message body and resend it to a new recipient.

Explanation

Do Not Forward applies a template that lets recipients read and reply while blocking forwarding, printing, copying, and adding recipients. The restriction is enforced by the protection service in supported clients.

Question 35Implement information protection

A protection template used by a sensitivity label has content expiration set to 30 days. What is the effect on content protected by this template?

  1. Users must re-apply the label every 30 days.
  2. The content is deleted from all repositories after 30 days.
  3. Users can no longer open the content after 30 days. Correct answer.
  4. The sensitivity label is automatically removed after 30 days.

Explanation

Content expiration sets a date, calculated from when the content was protected, after which the protection service refuses to issue a license, so users cannot open the content. The stored item and its label are not deleted or changed.

Question 36Implement information protection

An administrator needs a custom sensitive information type that reports a match only when a nine-digit employee number appears near the word Employee. How should the type be configured?

  1. Define the nine-digit number as a primary element, add the keyword as a supporting element, and set the confidence level. Correct answer.
  2. Add the word Employee to the seed set of a trainable classifier.
  3. Create a keyword dictionary containing the nine-digit employee numbers.
  4. Create a document fingerprint from a sample HR form.

Explanation

A custom sensitive information type is built from a primary element that uses a pattern, plus optional supporting elements such as keywords and proximity, with a confidence level that controls how likely a match is a true positive.

Question 37Implement information protection

How does an auto-labeling policy differ from a sensitivity label policy?

  1. An auto-labeling policy applies labels to content by matching conditions, while a sensitivity label policy makes labels available for users to apply. Correct answer.
  2. An auto-labeling policy can target only on-premises file shares.
  3. An auto-labeling policy publishes labels to users, while a sensitivity label policy applies labels to content.
  4. An auto-labeling policy replaces the need for published labels.

Explanation

Auto-labeling policies evaluate content against conditions and apply labels without user input, either in the service for content at rest or on the client while users work. Sensitivity label policies only publish labels so they appear in apps for users to select.

Question 38Implement information protection

A sensitivity label is published to groups and sites and its configuration includes privacy and external user access settings. What do these settings control on a SharePoint site that receives the label?

  1. The label that is automatically assigned to new documents in the site.
  2. The retention period applied to documents in the site.
  3. Whether files stored in the site are encrypted with the label's protection settings.
  4. The site's privacy setting and whether external sharing and access from unmanaged devices are allowed. Correct answer.

Explanation

Container settings in a label govern the site or group itself, including privacy, external sharing, access from unmanaged devices, and conditional access. They do not encrypt the files stored inside the container.

Question 39Implement information protection

An administrator wants to apply sensitivity labels to columns in an Azure SQL database. What must be done first?

  1. Publish a label with encryption to all users in the tenant.
  2. Create a DLP policy for endpoint devices.
  3. Move the database content into a SharePoint document library.
  4. Register the database in the Microsoft Purview data map and run a scan. Correct answer.

Explanation

Labels for schematized data assets such as Azure SQL columns are managed through the Microsoft Purview data map. The source must be registered and scanned so that the database and its columns are discovered before labels can be applied.

Question 40Implement information protection

A developer must add the ability to read and apply sensitivity labels to a custom line-of-business application. Which component should be used?

  1. A SharePoint retention policy
  2. An Exchange mail flow rule
  3. The Azure Information Protection unified labeling client
  4. The Microsoft Information Protection SDK Correct answer.

Explanation

The Microsoft Information Protection SDK exposes labeling and protection functionality so custom applications can read, apply, and enforce sensitivity labels and rights.

Question 41Implement information protection

Which prerequisite must be satisfied before a sensitivity label can encrypt content?

  1. The Rights Management protection service must be activated for the tenant. Correct answer.
  2. Documents must be stored in SharePoint Online.
  3. The tenant must have Defender for Cloud Apps enabled.
  4. Every user must have an Exchange Online mailbox.

Explanation

Label-based encryption depends on the Azure Rights Management protection service, which must be activated for the tenant before labels can apply encryption and issue usage licenses.

Question 42Implement information protection

A protection template grants a user only the View permission for a document. What can that user do?

  1. Forward the document to external recipients.
  2. Open, edit, and save changes to the document.
  3. Remove the protection so the document becomes unprotected.
  4. Open and read the document but not change it. Correct answer.

Explanation

The View usage right permits opening and reading content only. Editing, copying, printing, and forwarding each require additional rights granted by the template.

Question 43Implement information protection

An administrator must ensure that any email containing a project codename and sent to an external recipient is automatically protected with a specific sensitivity label, with no user action. Which approach meets the requirement?

  1. Set the label as the default label for emails.
  2. Create a DLP policy that blocks external email containing the codename.
  3. Run an auto-labeling policy in simulation mode.
  4. Create an Exchange mail flow rule that applies the sensitivity label when a message leaves the organization and contains the codename. Correct answer.

Explanation

Mail flow rules run in the service on every message, so a rule combining the external recipient condition with a keyword condition can attach a sensitivity label reliably and without user interaction.

Question 44Implement information protection

Which Microsoft Purview tool provides a consolidated view of label-related activities such as label applied, label changed, and label removed?

  1. Content explorer
  2. eDiscovery review set
  3. Activity explorer Correct answer.
  4. Data map

Explanation

Activity explorer surfaces labeling events together with other activities such as DLP rule matches and can be filtered by label, user, or activity type.

Question 45Implement information protection

An administrator publishes a new sensitivity label to all users, and a user reports that it is not yet visible in Word. What is the most likely reason?

  1. The label must be added to a DLP policy before it appears in Office apps.
  2. Word does not support sensitivity labels configured this way.
  3. The user is missing an E5 license.
  4. Label policy changes can take several hours, up to 24, to reach client applications. Correct answer.

Explanation

After a label policy is published or modified, distribution to client applications can take up to 24 hours, and users may need to restart the app or sign in again.

Question 46Implement information protection

An employee who protected files with a sensitivity label has left the organization, and no other user holds rights to those files. Which capability lets an administrator recover access?

  1. Re-publishing the same label with new permissions.
  2. Turning on Content explorer and opening the files from there.
  3. The super user feature for Azure Rights Management. Correct answer.
  4. Disabling the sensitivity label that applied the protection.

Explanation

The super user feature grants a designated group full control over all content protected by the tenant's protection service, which enables recovery when no owner or rights holder remains.

Question 47Implement information protection

An organization wants sensitivity labels available in Office apps on Windows, macOS, iOS, Android, and the web with the least administrative effort. Which approach should be used?

  1. Build a custom add-in by using the Microsoft Information Protection SDK.
  2. Deploy the Azure Information Protection unified labeling client to every device.
  3. Use File Server Resource Manager classification on a file server.
  4. Rely on built-in labeling in Office apps. Correct answer.

Explanation

Built-in labeling is part of Office apps across platforms and requires no separate client deployment. The unified labeling client is reserved for scenarios built-in labeling does not cover.

Question 48Implement information protection

A sensitivity label configured with encryption settings is published to groups and sites and then applied to a SharePoint site. What is the effect of the encryption settings on files stored in the site?

  1. Files are encrypted only after they are downloaded to a device.
  2. Every file in the site is encrypted with the label's permissions.
  3. The files are not encrypted by the container label; encryption applies only when the label is applied directly to a file. Correct answer.
  4. Only files created in the site's default document library are encrypted.

Explanation

Container labels apply site and group settings to the container and do not encrypt the content stored inside it. Encryption takes effect when the label is applied to an individual file or email.

Question 49Implement information protection

An administrator must detect a set of 500 product code names that cannot be described with a regular expression. Which sensitive information type component should be used?

  1. A keyword dictionary Correct answer.
  2. An exact data match schema
  3. A trainable classifier
  4. A document fingerprint

Explanation

A keyword dictionary stores a list of literal terms that Microsoft Purview can match directly. It can serve as a primary or supporting element in a custom sensitive information type when a pattern cannot be written.

Question 50Implement information protection

An administrator removes a user from a protection template that a sensitivity label uses. What is the effect on documents that were already labeled with that template?

  1. The user immediately loses access to all of the documents.
  2. The documents are automatically re-encrypted the next time they are opened.
  3. The documents keep the permissions that were applied when they were labeled, unless they are labeled again. Correct answer.
  4. The documents become unprotected.

Explanation

Rights are written into the protected item when the label is applied and are stored with the content. Later edits to the template affect future labeling only; existing items must be re-labeled or re-protected to pick up the change.