Microsoft SC-401 Practice Test 17

Question 160

The compliance lead must send encrypted external mail that can later be revoked through a portal. Which response most directly addresses the stated need?

Choose the Do Not Forward rights-protection option.
Define an Exchange mail flow encryption rule with the appropriate condition.
Use Purview Message Encryption for a supported external recipient experience.
Configure eligible Advanced Message Encryption with portal access and revocation.

Explanation

Correct Answer

D:

Advanced Message Encryption supports portal-dependent revocation for eligible external email. It directly meets the case's requirement to enable subsequent portal message revocation.

Incorrect Answers

A:

Rights management adds forwarding restrictions that transport encryption alone does not. That would prevent downstream forwarding; the question instead requires a way to enable subsequent portal message revocation.

B:

Server-side transport rules can trigger encryption from content-based conditions. That would enforce financial-email encryption automatically; the question instead requires a way to enable subsequent portal message revocation.

C:

Message Encryption supports non-Microsoft recipients using authenticated web experiences. That would share protected email across providers; the question instead requires a way to enable subsequent portal message revocation.

Question 161

Finance needs to encrypt any outgoing message whose content matches a standard credit-card SIT without user action. Which configuration BEST meets the requirement?

Define an Exchange mail flow encryption rule with the appropriate condition.
Configure eligible Advanced Message Encryption with portal access and revocation.
Use Purview Message Encryption for a supported external recipient experience.
Choose the Do Not Forward rights-protection option.

Explanation

Correct Answer

A:

Server-side transport rules can trigger encryption from content-based conditions. It directly meets the case's requirement to enforce financial-email encryption automatically.

Incorrect Answers

B:

Advanced Message Encryption supports portal-dependent revocation for eligible external email. That would enable subsequent portal message revocation; the question instead requires a way to enforce financial-email encryption automatically.

C:

Message Encryption supports non-Microsoft recipients using authenticated web experiences. That would share protected email across providers; the question instead requires a way to enforce financial-email encryption automatically.

D:

Rights management adds forwarding restrictions that transport encryption alone does not. That would prevent downstream forwarding; the question instead requires a way to enforce financial-email encryption automatically.

Question 162

A new scanner is deployed but the operations team has not defined which on-premises paths it may examine. Which Microsoft Purview approach should the administrator choose?

Use built-in Office labels and the separate modern Purview Windows client where needed.
Configure an approved repository list and scanner policy before execution.
Verify both identity permissions and enabled enforcement for those repositories.
Configure scanner discovery mode before requesting enforcement privileges.

Explanation

Correct Answer

B:

Explicit scanner targets constrain processing to sanctioned file locations. It directly meets the case's requirement to define permitted scanner scope.

Incorrect Answers

A:

Modern labeling support replaces retired add-in functionality. That would choose supported Windows labeling components; the question instead requires a way to define permitted scanner scope.

C:

A label-writing scan requires repository authorization and a policy that allows remediation. That would prepare secure scanner enforcement; the question instead requires a way to define permitted scanner scope.

D:

Discovery-first inventory separates assessment from production file changes. That would stage low-impact classification discovery; the question instead requires a way to define permitted scanner scope.

Question 163

The security owner wants change-free discovery evidence prior to any bulk labeling job. Which action most directly satisfies this requirement?

Configure an approved repository list and scanner policy before execution.
Use built-in Office labels and the separate modern Purview Windows client where needed.
Configure scanner discovery mode before requesting enforcement privileges.
Verify both identity permissions and enabled enforcement for those repositories.

Explanation

Correct Answer

C:

Discovery-first inventory separates assessment from production file changes. It directly meets the case's requirement to stage low-impact classification discovery.

Incorrect Answers

A:

Explicit scanner targets constrain processing to sanctioned file locations. That would define permitted scanner scope; the question instead requires a way to stage low-impact classification discovery.

B:

Modern labeling support replaces retired add-in functionality. That would choose supported Windows labeling components; the question instead requires a way to stage low-impact classification discovery.

D:

A label-writing scan requires repository authorization and a policy that allows remediation. That would prepare secure scanner enforcement; the question instead requires a way to stage low-impact classification discovery.

Question 164

A desktop administrator plans to use the old AIP Windows Office add-in with updated Microsoft 365 Apps. What is the most appropriate next action?

Configure scanner discovery mode before requesting enforcement privileges.
Configure an approved repository list and scanner policy before execution.
Verify both identity permissions and enabled enforcement for those repositories.
Use built-in Office labels and the separate modern Purview Windows client where needed.

Explanation

Correct Answer

D:

Modern labeling support replaces retired add-in functionality. It directly meets the case's requirement to choose supported Windows labeling components.

Incorrect Answers

A:

Discovery-first inventory separates assessment from production file changes. That would stage low-impact classification discovery; the question instead requires a way to choose supported Windows labeling components.

B:

Explicit scanner targets constrain processing to sanctioned file locations. That would define permitted scanner scope; the question instead requires a way to choose supported Windows labeling components.

C:

A label-writing scan requires repository authorization and a policy that allows remediation. That would prepare secure scanner enforcement; the question instead requires a way to choose supported Windows labeling components.

Question 165

The scanner identity needs to classify and relabel files in selected network shares. Which response most directly addresses the stated need?

Verify both identity permissions and enabled enforcement for those repositories.
Use built-in Office labels and the separate modern Purview Windows client where needed.
Configure an approved repository list and scanner policy before execution.
Configure scanner discovery mode before requesting enforcement privileges.

Explanation

Correct Answer

A:

A label-writing scan requires repository authorization and a policy that allows remediation. It directly meets the case's requirement to prepare secure scanner enforcement.

Incorrect Answers

B:

Modern labeling support replaces retired add-in functionality. That would choose supported Windows labeling components; the question instead requires a way to prepare secure scanner enforcement.

C:

Explicit scanner targets constrain processing to sanctioned file locations. That would define permitted scanner scope; the question instead requires a way to prepare secure scanner enforcement.

D:

Discovery-first inventory separates assessment from production file changes. That would stage low-impact classification discovery; the question instead requires a way to prepare secure scanner enforcement.

Question 166

An organization must block sending external Exchange email containing high-confidence patient identifiers. Which configuration BEST meets the requirement?

Apply a DLP policy to OneDrive accounts with appropriate conditions and actions.
Create a Microsoft Purview DLP policy scoped to Exchange Online with the matching SIT condition.
Run a Teams-scoped DLP policy in simulation mode without enforcement.
Scope a Microsoft Purview DLP policy to SharePoint Online sharing activities.

Explanation

Correct Answer

B:

Exchange DLP can evaluate outgoing messages and apply supported restriction actions. It directly meets the case's requirement to stop sensitive outbound email.

Incorrect Answers

A:

OneDrive DLP protects supported cloud-file sharing by policy conditions. That would protect work OneDrive sharing; the question instead requires a way to stop sensitive outbound email.

C:

Simulation permits detection and policy tuning before a supported Teams message restriction takes effect. That would baseline Teams message matches without blocking; the question instead requires a way to stop sensitive outbound email.

D:

SharePoint DLP can evaluate content and supported sharing operations in that location. That would protect externally shared SharePoint files; the question instead requires a way to stop sensitive outbound email.

Question 167

A confidential file is being shared externally from an approved SharePoint site. Which Microsoft Purview approach should the administrator choose?

Run a Teams-scoped DLP policy in simulation mode without enforcement.
Create a Microsoft Purview DLP policy scoped to Exchange Online with the matching SIT condition.
Scope a Microsoft Purview DLP policy to SharePoint Online sharing activities.
Apply a DLP policy to OneDrive accounts with appropriate conditions and actions.

Explanation

Correct Answer

C:

SharePoint DLP can evaluate content and supported sharing operations in that location. It directly meets the case's requirement to protect externally shared SharePoint files.

Incorrect Answers

A:

Simulation permits detection and policy tuning before a supported Teams message restriction takes effect. That would baseline Teams message matches without blocking; the question instead requires a way to protect externally shared SharePoint files.

B:

Exchange DLP can evaluate outgoing messages and apply supported restriction actions. That would stop sensitive outbound email; the question instead requires a way to protect externally shared SharePoint files.

D:

OneDrive DLP protects supported cloud-file sharing by policy conditions. That would protect work OneDrive sharing; the question instead requires a way to protect externally shared SharePoint files.

Question 168

A user tries to share a protected file from their personal work OneDrive. Which action most directly satisfies this requirement?

Run a Teams-scoped DLP policy in simulation mode without enforcement.
Scope a Microsoft Purview DLP policy to SharePoint Online sharing activities.
Create a Microsoft Purview DLP policy scoped to Exchange Online with the matching SIT condition.
Apply a DLP policy to OneDrive accounts with appropriate conditions and actions.

Explanation

Correct Answer

D:

OneDrive DLP protects supported cloud-file sharing by policy conditions. It directly meets the case's requirement to protect work OneDrive sharing.

Incorrect Answers

A:

Simulation permits detection and policy tuning before a supported Teams message restriction takes effect. That would baseline Teams message matches without blocking; the question instead requires a way to protect work OneDrive sharing.

B:

SharePoint DLP can evaluate content and supported sharing operations in that location. That would protect externally shared SharePoint files; the question instead requires a way to protect work OneDrive sharing.

C:

Exchange DLP can evaluate outgoing messages and apply supported restriction actions. That would stop sensitive outbound email; the question instead requires a way to protect work OneDrive sharing.

Question 169

Before blocking Teams messages, an organization needs a scoped baseline of sensitive-content matches without user interruption. What is the most appropriate next action?

Run a Teams-scoped DLP policy in simulation mode without enforcement.
Scope a Microsoft Purview DLP policy to SharePoint Online sharing activities.
Create a Microsoft Purview DLP policy scoped to Exchange Online with the matching SIT condition.
Apply a DLP policy to OneDrive accounts with appropriate conditions and actions.

Explanation

Correct Answer

A:

Simulation permits detection and policy tuning before a supported Teams message restriction takes effect. It directly meets the case's requirement to baseline Teams message matches without blocking.

Incorrect Answers

B:

SharePoint DLP can evaluate content and supported sharing operations in that location. That would protect externally shared SharePoint files; the question instead requires a way to baseline Teams message matches without blocking.

C:

Exchange DLP can evaluate outgoing messages and apply supported restriction actions. That would stop sensitive outbound email; the question instead requires a way to baseline Teams message matches without blocking.

D:

OneDrive DLP protects supported cloud-file sharing by policy conditions. That would protect work OneDrive sharing; the question instead requires a way to baseline Teams message matches without blocking.

Question 170

Finance wants a rule only when at least ten credit-card numbers are present in one eligible item. Which response most directly addresses the stated need?

Combine the relevant DLP conditions with the required logical grouping.
Set the DLP condition's instance-count threshold for the credit-card SIT.
Use a DLP condition based on the targeted sensitivity label.
Use the appropriate sensitive information type condition in DLP.

Explanation

Correct Answer

B:

DLP sensitive-info conditions can consider occurrence counts as well as type and confidence. It directly meets the case's requirement to enforce a minimum match count.

Incorrect Answers

A:

Rule logic can narrow matches to content satisfying multiple configured constraints. That would require multiple independent DLP conditions; the question instead requires a way to enforce a minimum match count.

C:

DLP can use sensitivity classification as an eligible policy condition. That would protect labeled content regardless of identifier pattern; the question instead requires a way to enforce a minimum match count.

D:

Content-based SIT detection is independent of discretionary manual labeling. That would catch unlabeled sensitive content; the question instead requires a way to enforce a minimum match count.

Pass Your Microsoft SC-401 Exam Easy!

Question 160

Explanation

Correct Answer

Incorrect Answers

Question 161

Explanation

Correct Answer

Incorrect Answers

Question 162

Explanation

Correct Answer

Incorrect Answers

Question 163

Explanation

Correct Answer

Incorrect Answers

Question 164

Explanation

Correct Answer

Incorrect Answers

Question 165

Explanation

Correct Answer

Incorrect Answers

Question 166

Explanation

Correct Answer

Incorrect Answers

Question 167

Explanation

Correct Answer

Incorrect Answers

Question 168

Explanation

Correct Answer

Incorrect Answers

Question 169

Explanation

Correct Answer

Incorrect Answers

Question 170

Explanation

Correct Answer

Incorrect Answers

Administering Information Security in Microsoft 365 (SC-401) Practice Tests