Microsoft SC-401 Practice Test 18

Question 170

Finance wants a rule only when at least ten credit-card numbers are present in one eligible item. Which response most directly addresses the stated need?

Combine the relevant DLP conditions with the required logical grouping.
Set the DLP condition's instance-count threshold for the credit-card SIT.
Use a DLP condition based on the targeted sensitivity label.
Use the appropriate sensitive information type condition in DLP.

Explanation

Correct Answer

DLP sensitive-info conditions can consider occurrence counts as well as type and confidence. It directly meets the case's requirement to enforce a minimum match count.

Incorrect Answers

Rule logic can narrow matches to content satisfying multiple configured constraints. That would require multiple independent DLP conditions; the question instead requires a way to enforce a minimum match count.

DLP can use sensitivity classification as an eligible policy condition. That would protect labeled content regardless of identifier pattern; the question instead requires a way to enforce a minimum match count.

Content-based SIT detection is independent of discretionary manual labeling. That would catch unlabeled sensitive content; the question instead requires a way to enforce a minimum match count.

Question 171

Compliance needs a policy only for items bearing a specific Restricted sensitivity label. Which configuration BEST meets the requirement?

Set the DLP condition's instance-count threshold for the credit-card SIT.
Use the appropriate sensitive information type condition in DLP.
Use a DLP condition based on the targeted sensitivity label.
Combine the relevant DLP conditions with the required logical grouping.

Explanation

Correct Answer

DLP can use sensitivity classification as an eligible policy condition. It directly meets the case's requirement to protect labeled content regardless of identifier pattern.

Incorrect Answers

DLP sensitive-info conditions can consider occurrence counts as well as type and confidence. That would enforce a minimum match count; the question instead requires a way to protect labeled content regardless of identifier pattern.

Content-based SIT detection is independent of discretionary manual labeling. That would catch unlabeled sensitive content; the question instead requires a way to protect labeled content regardless of identifier pattern.

Question 172

A hospital must catch standard patient identifiers even if employees neglect to label the content. Which Microsoft Purview approach should the administrator choose?

Use a DLP condition based on the targeted sensitivity label.
Combine the relevant DLP conditions with the required logical grouping.
Set the DLP condition's instance-count threshold for the credit-card SIT.
Use the appropriate sensitive information type condition in DLP.

Explanation

Correct Answer

Content-based SIT detection is independent of discretionary manual labeling. It directly meets the case's requirement to catch unlabeled sensitive content.

Incorrect Answers

DLP sensitive-info conditions can consider occurrence counts as well as type and confidence. That would enforce a minimum match count; the question instead requires a way to catch unlabeled sensitive content.

Question 173

An alert must fire only when both regulated identifiers and a distinct contextual condition are satisfied. Which action most directly satisfies this requirement?

Combine the relevant DLP conditions with the required logical grouping.
Use a DLP condition based on the targeted sensitivity label.
Use the appropriate sensitive information type condition in DLP.
Set the DLP condition's instance-count threshold for the credit-card SIT.

Explanation

Correct Answer

Rule logic can narrow matches to content satisfying multiple configured constraints. It directly meets the case's requirement to require multiple independent DLP conditions.

Incorrect Answers

Content-based SIT detection is independent of discretionary manual labeling. That would catch unlabeled sensitive content; the question instead requires a way to require multiple independent DLP conditions.

DLP sensitive-info conditions can consider occurrence counts as well as type and confidence. That would enforce a minimum match count; the question instead requires a way to require multiple independent DLP conditions.

Question 174

Security wants a baseline of likely matches but is not ready to interrupt business operations. What is the most appropriate next action?

Configure a DLP policy tip or supported user notification.
Run the candidate DLP policy in simulation without enforcement.
Configure the appropriate DLP block action for the supported location.
Allow an eligible DLP override with business justification.

Explanation

Correct Answer

Simulation evaluates conditions before production restriction actions. It directly meets the case's requirement to assess DLP impact safely.

Incorrect Answers

DLP notifications explain why a matched operation is risky. That would notify users during a DLP match; the question instead requires a way to assess DLP impact safely.

Block enforcement prevents the matching operation rather than merely recording it. That would prevent a sensitive-data transfer; the question instead requires a way to assess DLP impact safely.

Supported override actions capture user rationale for policy-exception review. That would enable auditable business overrides; the question instead requires a way to assess DLP impact safely.

Question 175

A business requires a clear user-facing warning when a permitted file operation matches policy. Which response most directly addresses the stated need?

Configure the appropriate DLP block action for the supported location.
Allow an eligible DLP override with business justification.
Configure a DLP policy tip or supported user notification.
Run the candidate DLP policy in simulation without enforcement.

Explanation

Correct Answer

DLP notifications explain why a matched operation is risky. It directly meets the case's requirement to notify users during a DLP match.

Incorrect Answers

Block enforcement prevents the matching operation rather than merely recording it. That would prevent a sensitive-data transfer; the question instead requires a way to notify users during a DLP match.

Supported override actions capture user rationale for policy-exception review. That would enable auditable business overrides; the question instead requires a way to notify users during a DLP match.

Simulation evaluates conditions before production restriction actions. That would assess DLP impact safely; the question instead requires a way to notify users during a DLP match.

Question 176

The policy must deny external transmission of the highest-risk records rather than only warn. Which configuration BEST meets the requirement?

Configure a DLP policy tip or supported user notification.
Allow an eligible DLP override with business justification.
Run the candidate DLP policy in simulation without enforcement.
Configure the appropriate DLP block action for the supported location.

Explanation

Correct Answer

Block enforcement prevents the matching operation rather than merely recording it. It directly meets the case's requirement to prevent a sensitive-data transfer.

Incorrect Answers

DLP notifications explain why a matched operation is risky. That would notify users during a DLP match; the question instead requires a way to prevent a sensitive-data transfer.

Supported override actions capture user rationale for policy-exception review. That would enable auditable business overrides; the question instead requires a way to prevent a sensitive-data transfer.

Simulation evaluates conditions before production restriction actions. That would assess DLP impact safely; the question instead requires a way to prevent a sensitive-data transfer.

Question 177

Staff may proceed after documenting a compelling business reason under an approved exception process. Which Microsoft Purview approach should the administrator choose?

Allow an eligible DLP override with business justification.
Configure the appropriate DLP block action for the supported location.
Run the candidate DLP policy in simulation without enforcement.
Configure a DLP policy tip or supported user notification.

Explanation

Correct Answer

Supported override actions capture user rationale for policy-exception review. It directly meets the case's requirement to enable auditable business overrides.

Incorrect Answers

Block enforcement prevents the matching operation rather than merely recording it. That would prevent a sensitive-data transfer; the question instead requires a way to enable auditable business overrides.

Simulation evaluates conditions before production restriction actions. That would assess DLP impact safely; the question instead requires a way to enable auditable business overrides.

DLP notifications explain why a matched operation is risky. That would notify users during a DLP match; the question instead requires a way to enable auditable business overrides.

Question 178

A policy engineer needs to create DLP rules but should not become the Microsoft 365 global administrator. Which action most directly satisfies this requirement?

Assign scoped reporting or audit permissions.
Grant the appropriate least-privilege DLP administration role group.
Assign suitable DLP investigation or alert review permissions.
Configure the suitable Purview role assignment for alert management.

Explanation

Correct Answer

Purview role-based authorization separates DLP policy authoring from tenant superuser access. It directly meets the case's requirement to delegate DLP configuration.

Incorrect Answers

Read-only audit and reporting do not require DLP policy author privileges. That would provide DLP audit visibility; the question instead requires a way to delegate DLP configuration.

Investigation rights can be separated from policy-change rights. That would let responders inspect DLP alerts; the question instead requires a way to delegate DLP configuration.

Alert response can be delegated through service role groups. That would permit DLP case triage; the question instead requires a way to delegate DLP configuration.

Question 179

A help-desk investigator needs to review DLP alert evidence without altering production policies. What is the most appropriate next action?

Configure the suitable Purview role assignment for alert management.
Assign scoped reporting or audit permissions.
Assign suitable DLP investigation or alert review permissions.
Grant the appropriate least-privilege DLP administration role group.

Explanation

Correct Answer

Investigation rights can be separated from policy-change rights. It directly meets the case's requirement to let responders inspect DLP alerts.

Incorrect Answers

Alert response can be delegated through service role groups. That would permit DLP case triage; the question instead requires a way to let responders inspect DLP alerts.

Read-only audit and reporting do not require DLP policy author privileges. That would provide DLP audit visibility; the question instead requires a way to let responders inspect DLP alerts.

Purview role-based authorization separates DLP policy authoring from tenant superuser access. That would delegate DLP configuration; the question instead requires a way to let responders inspect DLP alerts.

Question 180

An auditor must review DLP policy activity records without creating new enforcement rules. Which response most directly addresses the stated need?

Assign suitable DLP investigation or alert review permissions.
Configure the suitable Purview role assignment for alert management.
Grant the appropriate least-privilege DLP administration role group.
Assign scoped reporting or audit permissions.

Explanation

Correct Answer

Read-only audit and reporting do not require DLP policy author privileges. It directly meets the case's requirement to provide DLP audit visibility.

Incorrect Answers

Investigation rights can be separated from policy-change rights. That would let responders inspect DLP alerts; the question instead requires a way to provide DLP audit visibility.

Alert response can be delegated through service role groups. That would permit DLP case triage; the question instead requires a way to provide DLP audit visibility.

Purview role-based authorization separates DLP policy authoring from tenant superuser access. That would delegate DLP configuration; the question instead requires a way to provide DLP audit visibility.

Administering Information Security in Microsoft 365 (SC-401) Practice Tests

Microsoft SC-401 Practice Test 16 - 10 Questions (Last Reviewed 19-Oct-2026)
Microsoft SC-401 Practice Test 17 - 10 Questions (Last Reviewed 18-Oct-2026)
Microsoft SC-401 Practice Test 18 - 10 Questions (Last Reviewed 17-Oct-2026)
Microsoft SC-401 Practice Test 19 - 10 Questions (Last Reviewed 16-Oct-2026)
Microsoft SC-401 Practice Test 20 - 10 Questions (Last Reviewed 15-Oct-2026)

Pass Your Microsoft SC-401 Exam Easy!

Question 170

Explanation

Correct Answer

Incorrect Answers

Question 171

Explanation

Correct Answer

Incorrect Answers

Question 172

Explanation

Correct Answer

Incorrect Answers

Question 173

Explanation

Correct Answer

Incorrect Answers

Question 174

Explanation

Correct Answer

Incorrect Answers

Question 175

Explanation

Correct Answer

Incorrect Answers

Question 176

Explanation

Correct Answer

Incorrect Answers

Question 177

Explanation

Correct Answer

Incorrect Answers

Question 178

Explanation

Correct Answer

Incorrect Answers

Question 179

Explanation

Correct Answer

Incorrect Answers

Question 180

Explanation

Correct Answer

Incorrect Answers

Administering Information Security in Microsoft 365 (SC-401) Practice Tests