Microsoft SC-401 Practice Test 22

Question 210

An investigator must determine which policy and condition generated a high-severity DLP alert. Which response most directly addresses the stated need?

Refine the SIT or rule conditions and rerun controlled tests.
Open the DLP alert details and examine matched policy conditions.
Compare the relevant DLP activity and alert trends over defined periods.
Correlate DLP alert evidence with available activity records.

Explanation

Correct Answer

Alert evidence ties the activity to the triggering rule and affected content. It directly meets the case's requirement to trace a DLP alert to its rule.

Incorrect Answers

Root-cause tuning addresses false positives without ignoring genuine future detections. That would remediate recurring DLP false alerts; the question instead requires a way to trace a DLP alert to its rule.

Operational reporting can measure event counts before and after enforcement. That would assess restriction effectiveness; the question instead requires a way to trace a DLP alert to its rule.

Activity timelines provide context around the same user's associated operations. That would reconstruct a DLP incident timeline; the question instead requires a way to trace a DLP alert to its rule.

Question 211

A DLP event must be linked with other endpoint events from the same user in an incident investigation. Which configuration BEST meets the requirement?

Open the DLP alert details and examine matched policy conditions.
Compare the relevant DLP activity and alert trends over defined periods.
Correlate DLP alert evidence with available activity records.
Refine the SIT or rule conditions and rerun controlled tests.

Explanation

Correct Answer

Activity timelines provide context around the same user's associated operations. It directly meets the case's requirement to reconstruct a DLP incident timeline.

Incorrect Answers

Alert evidence ties the activity to the triggering rule and affected content. That would trace a DLP alert to its rule; the question instead requires a way to reconstruct a DLP incident timeline.

Operational reporting can measure event counts before and after enforcement. That would assess restriction effectiveness; the question instead requires a way to reconstruct a DLP incident timeline.

Question 212

A policy owner wants to quantify whether new restrictions decreased violations after deployment. Which Microsoft Purview approach should the administrator choose?

Correlate DLP alert evidence with available activity records.
Refine the SIT or rule conditions and rerun controlled tests.
Open the DLP alert details and examine matched policy conditions.
Compare the relevant DLP activity and alert trends over defined periods.

Explanation

Correct Answer

Operational reporting can measure event counts before and after enforcement. It directly meets the case's requirement to assess restriction effectiveness.

Incorrect Answers

Activity timelines provide context around the same user's associated operations. That would reconstruct a DLP incident timeline; the question instead requires a way to assess restriction effectiveness.

Alert evidence ties the activity to the triggering rule and affected content. That would trace a DLP alert to its rule; the question instead requires a way to assess restriction effectiveness.

Question 213

An administrator discovers an alert was caused by a known benign test file and wants to avoid similar noise. Which action most directly satisfies this requirement?

Refine the SIT or rule conditions and rerun controlled tests.
Compare the relevant DLP activity and alert trends over defined periods.
Correlate DLP alert evidence with available activity records.
Open the DLP alert details and examine matched policy conditions.

Explanation

Correct Answer

Root-cause tuning addresses false positives without ignoring genuine future detections. It directly meets the case's requirement to remediate recurring DLP false alerts.

Incorrect Answers

Operational reporting can measure event counts before and after enforcement. That would assess restriction effectiveness; the question instead requires a way to remediate recurring DLP false alerts.

Activity timelines provide context around the same user's associated operations. That would reconstruct a DLP incident timeline; the question instead requires a way to remediate recurring DLP false alerts.

Alert evidence ties the activity to the triggering rule and affected content. That would trace a DLP alert to its rule; the question instead requires a way to remediate recurring DLP false alerts.

Question 214

An organization wants to stop credit-card numbers sent in Teams messages, not just emails. What is the most appropriate next action?

Use Exchange DLP with a content-based sensitive information condition.
Select the supported Teams chat and channel messages DLP location.
Configure Endpoint DLP device activity rules rather than only a cloud-location policy.
Scope DLP to OneDrive and configure the sharing restriction.

Explanation

Correct Answer

Workload selection determines which message surfaces a DLP rule examines. It directly meets the case's requirement to protect Teams message content.

Incorrect Answers

Exchange DLP can evaluate eligible message contents and supported attachments. That would enforce content-based email protection; the question instead requires a way to protect Teams message content.

Device-scoped DLP monitors supported local file operations on onboarded endpoints. That would restrict removable-media copying; the question instead requires a way to protect Teams message content.

OneDrive policy actions can govern supported sensitive-file sharing. That would stop sensitive OneDrive sharing; the question instead requires a way to protect Teams message content.

Question 215

A file containing a regulated ID must not be shared from an employee's OneDrive. Which response most directly addresses the stated need?

Use Exchange DLP with a content-based sensitive information condition.
Select the supported Teams chat and channel messages DLP location.
Scope DLP to OneDrive and configure the sharing restriction.
Configure Endpoint DLP device activity rules rather than only a cloud-location policy.

Explanation

Correct Answer

OneDrive policy actions can govern supported sensitive-file sharing. It directly meets the case's requirement to stop sensitive OneDrive sharing.

Incorrect Answers

Exchange DLP can evaluate eligible message contents and supported attachments. That would enforce content-based email protection; the question instead requires a way to stop sensitive OneDrive sharing.

Workload selection determines which message surfaces a DLP rule examines. That would protect Teams message content; the question instead requires a way to stop sensitive OneDrive sharing.

Device-scoped DLP monitors supported local file operations on onboarded endpoints. That would restrict removable-media copying; the question instead requires a way to stop sensitive OneDrive sharing.

Question 216

A CFO asks to protect email attachments containing confidential information regardless of manual labels. Which configuration BEST meets the requirement?

Scope DLP to OneDrive and configure the sharing restriction.
Select the supported Teams chat and channel messages DLP location.
Configure Endpoint DLP device activity rules rather than only a cloud-location policy.
Use Exchange DLP with a content-based sensitive information condition.

Explanation

Correct Answer

Exchange DLP can evaluate eligible message contents and supported attachments. It directly meets the case's requirement to enforce content-based email protection.

Incorrect Answers

OneDrive policy actions can govern supported sensitive-file sharing. That would stop sensitive OneDrive sharing; the question instead requires a way to enforce content-based email protection.

Workload selection determines which message surfaces a DLP rule examines. That would protect Teams message content; the question instead requires a way to enforce content-based email protection.

Device-scoped DLP monitors supported local file operations on onboarded endpoints. That would restrict removable-media copying; the question instead requires a way to enforce content-based email protection.

Question 217

The organization wants endpoint protection against copying protected documents to removable media. Which Microsoft Purview approach should the administrator choose?

Configure Endpoint DLP device activity rules rather than only a cloud-location policy.
Scope DLP to OneDrive and configure the sharing restriction.
Use Exchange DLP with a content-based sensitive information condition.
Select the supported Teams chat and channel messages DLP location.

Explanation

Correct Answer

Device-scoped DLP monitors supported local file operations on onboarded endpoints. It directly meets the case's requirement to restrict removable-media copying.

Incorrect Answers

OneDrive policy actions can govern supported sensitive-file sharing. That would stop sensitive OneDrive sharing; the question instead requires a way to restrict removable-media copying.

Exchange DLP can evaluate eligible message contents and supported attachments. That would enforce content-based email protection; the question instead requires a way to restrict removable-media copying.

Workload selection determines which message surfaces a DLP rule examines. That would protect Teams message content; the question instead requires a way to restrict removable-media copying.

Question 218

A department is testing a new DLP rule and cannot afford immediate block events during tuning. Which action most directly satisfies this requirement?

Enable supported override with justification for narrowly defined conditions.
Simulate the DLP policy and inspect matched events.
Configure supported policy-tip and notification behavior.
Disable override and apply the required block action.

Explanation

Correct Answer

Simulated evaluation informs readiness without changing the user operation. It directly meets the case's requirement to test enforcement candidates safely.

Incorrect Answers

Captured rationale makes policy exceptions reviewable instead of invisible. That would allow justified audited transfers; the question instead requires a way to test enforcement candidates safely.

User-facing explanations support compliance when sensitive actions are blocked. That would provide DLP education at enforcement; the question instead requires a way to test enforcement candidates safely.

A hard-block policy prevents continuation by discretionary override. That would enforce a strict nonoverrideable control; the question instead requires a way to test enforcement candidates safely.

Question 219

A regulated business requires a blocked user to see a notification explaining the protection policy. What is the most appropriate next action?

Disable override and apply the required block action.
Simulate the DLP policy and inspect matched events.
Configure supported policy-tip and notification behavior.
Enable supported override with justification for narrowly defined conditions.

Explanation

Correct Answer

User-facing explanations support compliance when sensitive actions are blocked. It directly meets the case's requirement to provide DLP education at enforcement.

Incorrect Answers

A hard-block policy prevents continuation by discretionary override. That would enforce a strict nonoverrideable control; the question instead requires a way to provide DLP education at enforcement.

Simulated evaluation informs readiness without changing the user operation. That would test enforcement candidates safely; the question instead requires a way to provide DLP education at enforcement.

Captured rationale makes policy exceptions reviewable instead of invisible. That would allow justified audited transfers; the question instead requires a way to provide DLP education at enforcement.

Question 220

A red-team scenario demands an unconditional block even when a user enters business justification. Which response most directly addresses the stated need?

Enable supported override with justification for narrowly defined conditions.
Simulate the DLP policy and inspect matched events.
Configure supported policy-tip and notification behavior.
Disable override and apply the required block action.

Explanation

Correct Answer

A hard-block policy prevents continuation by discretionary override. It directly meets the case's requirement to enforce a strict nonoverrideable control.

Incorrect Answers

Captured rationale makes policy exceptions reviewable instead of invisible. That would allow justified audited transfers; the question instead requires a way to enforce a strict nonoverrideable control.

Simulated evaluation informs readiness without changing the user operation. That would test enforcement candidates safely; the question instead requires a way to enforce a strict nonoverrideable control.

User-facing explanations support compliance when sensitive actions are blocked. That would provide DLP education at enforcement; the question instead requires a way to enforce a strict nonoverrideable control.

Administering Information Security in Microsoft 365 (SC-401) Practice Tests

Microsoft SC-401 Practice Test 20 - 10 Questions (Last Reviewed 15-Oct-2026)
Microsoft SC-401 Practice Test 21 - 10 Questions (Last Reviewed 14-Oct-2026)
Microsoft SC-401 Practice Test 22 - 10 Questions (Last Reviewed 13-Oct-2026)
Microsoft SC-401 Practice Test 23 - 10 Questions (Last Reviewed 12-Oct-2026)
Microsoft SC-401 Practice Test 24 - 10 Questions (Last Reviewed 11-Oct-2026)

Pass Your Microsoft SC-401 Exam Easy!

Question 210

Explanation

Correct Answer

Incorrect Answers

Question 211

Explanation

Correct Answer

Incorrect Answers

Question 212

Explanation

Correct Answer

Incorrect Answers

Question 213

Explanation

Correct Answer

Incorrect Answers

Question 214

Explanation

Correct Answer

Incorrect Answers

Question 215

Explanation

Correct Answer

Incorrect Answers

Question 216

Explanation

Correct Answer

Incorrect Answers

Question 217

Explanation

Correct Answer

Incorrect Answers

Question 218

Explanation

Correct Answer

Incorrect Answers

Question 219

Explanation

Correct Answer

Incorrect Answers

Question 220

Explanation

Correct Answer

Incorrect Answers

Administering Information Security in Microsoft 365 (SC-401) Practice Tests