Microsoft SC-401 Practice Test 3

Question 20

A security team wants DLP to detect files matching a known form using its already-created fingerprint. Which response most directly addresses the stated need?

Configure a partial-match document fingerprint with suitable confidence.
Upload a representative form and create the fingerprint-based SIT.
Set the document fingerprint's high-confidence matching to Exact.
Reference the fingerprint-based SIT in a compatible DLP rule.

Explanation

Correct Answer

D:

Fingerprint-based sensitive information types can be used as DLP detection conditions in supported workloads. It directly meets the case's requirement to enforce protection on matched forms.

Incorrect Answers

A:

Partial fingerprint matching tolerates some document differences subject to configured thresholds. That would match variable instances of a form; the question instead requires a way to enforce protection on matched forms.

B:

The text template is the reference needed to derive a document fingerprint. That would establish a template fingerprint; the question instead requires a way to enforce protection on matched forms.

C:

Exact text matching rejects even small text changes relative to the fingerprint template. That would find exact-text form copies; the question instead requires a way to enforce protection on matched forms.

Question 21

Photographed passport images evade a rule that finds typed passport numbers in ordinary text. Which configuration BEST meets the requirement?

Enable the supported OCR capability for relevant image content in classification.
Tune the relevant SIT detection conditions rather than enabling OCR as the primary fix.
Review OCR-supported locations and formats against the DLP policy scope.
Test the rule in simulation and review detected activities before enforcing a block.

Explanation

Correct Answer

A:

OCR extracts textual evidence from supported images so sensitive information detection can evaluate it. It directly meets the case's requirement to classify text embedded in images.

Incorrect Answers

B:

SIT confidence, patterns, and evidence govern matching on already-extractable text. That would correct a text-pattern false negative; the question instead requires a way to classify text embedded in images.

C:

Image text detection must be evaluated against the supported content and location coverage. That would establish OCR coverage boundaries; the question instead requires a way to classify text embedded in images.

D:

A simulation separates detection tuning from immediate disruption of legitimate work. That would test OCR detection without immediate blocking; the question instead requires a way to classify text embedded in images.

Question 22

A PDF contains selectable text, and the detector already finds patterns without visual extraction. Which Microsoft Purview approach should the administrator choose?

Enable the supported OCR capability for relevant image content in classification.
Tune the relevant SIT detection conditions rather than enabling OCR as the primary fix.
Test the rule in simulation and review detected activities before enforcing a block.
Review OCR-supported locations and formats against the DLP policy scope.

Explanation

Correct Answer

B:

SIT confidence, patterns, and evidence govern matching on already-extractable text. It directly meets the case's requirement to correct a text-pattern false negative.

Incorrect Answers

A:

OCR extracts textual evidence from supported images so sensitive information detection can evaluate it. That would classify text embedded in images; the question instead requires a way to correct a text-pattern false negative.

C:

A simulation separates detection tuning from immediate disruption of legitimate work. That would test OCR detection without immediate blocking; the question instead requires a way to correct a text-pattern false negative.

D:

Image text detection must be evaluated against the supported content and location coverage. That would establish OCR coverage boundaries; the question instead requires a way to correct a text-pattern false negative.

Question 23

An administrator wants to know whether an OCR-based policy applies to the intended locations and file types before expansion. Which action most directly satisfies this requirement?

Enable the supported OCR capability for relevant image content in classification.
Test the rule in simulation and review detected activities before enforcing a block.
Review OCR-supported locations and formats against the DLP policy scope.
Tune the relevant SIT detection conditions rather than enabling OCR as the primary fix.

Explanation

Correct Answer

C:

Image text detection must be evaluated against the supported content and location coverage. It directly meets the case's requirement to establish OCR coverage boundaries.

Incorrect Answers

A:

OCR extracts textual evidence from supported images so sensitive information detection can evaluate it. That would classify text embedded in images; the question instead requires a way to establish OCR coverage boundaries.

B:

A simulation separates detection tuning from immediate disruption of legitimate work. That would test OCR detection without immediate blocking; the question instead requires a way to establish OCR coverage boundaries.

D:

SIT confidence, patterns, and evidence govern matching on already-extractable text. That would correct a text-pattern false negative; the question instead requires a way to establish OCR coverage boundaries.

Question 24

A rollout must measure false positives from OCR-extracted text before a blocking action reaches users. What is the most appropriate next action?

Review OCR-supported locations and formats against the DLP policy scope.
Tune the relevant SIT detection conditions rather than enabling OCR as the primary fix.
Enable the supported OCR capability for relevant image content in classification.
Test the rule in simulation and review detected activities before enforcing a block.

Explanation

Correct Answer

D:

A simulation separates detection tuning from immediate disruption of legitimate work. It directly meets the case's requirement to test OCR detection without immediate blocking.

Incorrect Answers

A:

Image text detection must be evaluated against the supported content and location coverage. That would establish OCR coverage boundaries; the question instead requires a way to test OCR detection without immediate blocking.

B:

SIT confidence, patterns, and evidence govern matching on already-extractable text. That would correct a text-pattern false negative; the question instead requires a way to test OCR detection without immediate blocking.

C:

OCR extracts textual evidence from supported images so sensitive information detection can evaluate it. That would classify text embedded in images; the question instead requires a way to test OCR detection without immediate blocking.

Question 25

The compliance lead asks for a tenant-level trend in how much content matches sensitive information types over time. Which response most directly addresses the stated need?

Use Data explorer's classification views.
Use Content explorer with appropriate content-inspection permissions.
Investigate relevant labeling activities in Activity explorer.
Open the relevant DLP alert or activity details in Microsoft Purview.

Explanation

Correct Answer

A:

Data explorer gives aggregate classification visibility rather than primarily opening an individual item. It directly meets the case's requirement to measure classification prevalence.

Incorrect Answers

B:

Content explorer supports locating and reviewing classified items subject to its role model. That would examine specific classified items; the question instead requires a way to measure classification prevalence.

C:

Activity explorer records supported information-protection and DLP activities for operational review. That would inspect labeling actions; the question instead requires a way to measure classification prevalence.

D:

DLP alert records contextualize a specific policy match rather than only aggregate classification. That would examine a specific DLP violation; the question instead requires a way to measure classification prevalence.

Question 26

An authorized investigator needs item-level detail for documents associated with a specific sensitive information type. Which configuration BEST meets the requirement?

Use Data explorer's classification views.
Use Content explorer with appropriate content-inspection permissions.
Investigate relevant labeling activities in Activity explorer.
Open the relevant DLP alert or activity details in Microsoft Purview.

Explanation

Correct Answer

B:

Content explorer supports locating and reviewing classified items subject to its role model. It directly meets the case's requirement to examine specific classified items.

Incorrect Answers

A:

Data explorer gives aggregate classification visibility rather than primarily opening an individual item. That would measure classification prevalence; the question instead requires a way to examine specific classified items.

C:

Activity explorer records supported information-protection and DLP activities for operational review. That would inspect labeling actions; the question instead requires a way to examine specific classified items.

D:

DLP alert records contextualize a specific policy match rather than only aggregate classification. That would examine a specific DLP violation; the question instead requires a way to examine specific classified items.

Question 27

A manager wants to see user actions involving sensitivity labels, not merely the number of classified items. Which Microsoft Purview approach should the administrator choose?

Open the relevant DLP alert or activity details in Microsoft Purview.
Use Content explorer with appropriate content-inspection permissions.
Investigate relevant labeling activities in Activity explorer.
Use Data explorer's classification views.

Explanation

Correct Answer

C:

Activity explorer records supported information-protection and DLP activities for operational review. It directly meets the case's requirement to inspect labeling actions.

Incorrect Answers

A:

DLP alert records contextualize a specific policy match rather than only aggregate classification. That would examine a specific DLP violation; the question instead requires a way to inspect labeling actions.

B:

Content explorer supports locating and reviewing classified items subject to its role model. That would examine specific classified items; the question instead requires a way to inspect labeling actions.

D:

Data explorer gives aggregate classification visibility rather than primarily opening an individual item. That would measure classification prevalence; the question instead requires a way to inspect labeling actions.

Question 28

A protection specialist must review an individual DLP violation's affected content and rule conditions. Which action most directly satisfies this requirement?

Use Data explorer's classification views.
Investigate relevant labeling activities in Activity explorer.
Use Content explorer with appropriate content-inspection permissions.
Open the relevant DLP alert or activity details in Microsoft Purview.

Explanation

Correct Answer

D:

DLP alert records contextualize a specific policy match rather than only aggregate classification. It directly meets the case's requirement to examine a specific DLP violation.

Incorrect Answers

A:

Data explorer gives aggregate classification visibility rather than primarily opening an individual item. That would measure classification prevalence; the question instead requires a way to examine a specific DLP violation.

B:

Activity explorer records supported information-protection and DLP activities for operational review. That would inspect labeling actions; the question instead requires a way to examine a specific DLP violation.

C:

Content explorer supports locating and reviewing classified items subject to its role model. That would examine specific classified items; the question instead requires a way to examine a specific DLP violation.

Question 29

A new custom SIT misclassifies harmless invoice numbers; the team needs a safe first correction. What is the most appropriate next action?

Refine primary patterns and corroborative evidence against test samples.
Validate the SIT with a known positive sample and inspect match details.
Run the sensitive information type's supported test workflow on representative files.
Document and review built-in and custom SIT definitions with assigned owners.

Explanation

Correct Answer

A:

SIT detection depends on patterns, confidence, and proximity; samples expose false matches. It directly meets the case's requirement to tune overly broad invoice detection.

Incorrect Answers

B:

A controlled positive test separates classifier configuration faults from missing data or unsupported context. That would diagnose a missed valid classifier match; the question instead requires a way to tune overly broad invoice detection.

C:

Testing classification against reference samples reveals whether detection logic matches the intended content. That would validate a new sensitive information type; the question instead requires a way to tune overly broad invoice detection.

D:

A governed classifier inventory supports traceability and maintenance of detection logic. That would maintain classifier governance evidence; the question instead requires a way to tune overly broad invoice detection.

Question 30

A rule unexpectedly fails to detect a known sample containing a real employee ID. Which response most directly addresses the stated need?

Run the sensitive information type's supported test workflow on representative files.
Validate the SIT with a known positive sample and inspect match details.
Refine primary patterns and corroborative evidence against test samples.
Document and review built-in and custom SIT definitions with assigned owners.

Explanation

Correct Answer

B:

A controlled positive test separates classifier configuration faults from missing data or unsupported context. It directly meets the case's requirement to diagnose a missed valid classifier match.

Incorrect Answers

A:

Testing classification against reference samples reveals whether detection logic matches the intended content. That would validate a new sensitive information type; the question instead requires a way to diagnose a missed valid classifier match.

C:

SIT detection depends on patterns, confidence, and proximity; samples expose false matches. That would tune overly broad invoice detection; the question instead requires a way to diagnose a missed valid classifier match.

D:

A governed classifier inventory supports traceability and maintenance of detection logic. That would maintain classifier governance evidence; the question instead requires a way to diagnose a missed valid classifier match.

Pass Your Microsoft SC-401 Exam Easy!

Question 20

Explanation

Correct Answer

Incorrect Answers

Question 21

Explanation

Correct Answer

Incorrect Answers

Question 22

Explanation

Correct Answer

Incorrect Answers

Question 23

Explanation

Correct Answer

Incorrect Answers

Question 24

Explanation

Correct Answer

Incorrect Answers

Question 25

Explanation

Correct Answer

Incorrect Answers

Question 26

Explanation

Correct Answer

Incorrect Answers

Question 27

Explanation

Correct Answer

Incorrect Answers

Question 28

Explanation

Correct Answer

Incorrect Answers

Question 29

Explanation

Correct Answer

Incorrect Answers

Question 30

Explanation

Correct Answer

Incorrect Answers

Administering Information Security in Microsoft 365 (SC-401) Practice Tests