Microsoft SC-401 Practice Test 34

Question 330

A compliance rule starts five years after an employee exits, not when a document was authored. Which response most directly addresses the stated need?

Choose the label-applied retention starting point.
Use an event-based retention label with the documented departure event.
Set the retention start trigger to file creation.
Use a supported last-modified retention trigger.

Explanation

Correct Answer

B:

Event-based labels anchor the retention period to a tracked business event. It directly meets the case's requirement to calculate retention from an employee exit.

Incorrect Answers

A:

Label assignment provides a different clock from creation or modification. That would anchor retention to label application; the question instead requires a way to calculate retention from an employee exit.

C:

Creation-time rules anchor the period to a stable initial timestamp. That would start a three-year creation clock; the question instead requires a way to calculate retention from an employee exit.

D:

Modification-time clocks can extend as the file changes. That would start retention from latest edit; the question instead requires a way to calculate retention from an employee exit.

Question 331

A label requires seven years of retention starting on the date the item receives the label. Which configuration BEST meets the requirement?

Use an event-based retention label with the documented departure event.
Set the retention start trigger to file creation.
Choose the label-applied retention starting point.
Use a supported last-modified retention trigger.

Explanation

Correct Answer

C:

Label assignment provides a different clock from creation or modification. It directly meets the case's requirement to anchor retention to label application.

Incorrect Answers

A:

Event-based labels anchor the retention period to a tracked business event. That would calculate retention from an employee exit; the question instead requires a way to anchor retention to label application.

B:

Creation-time rules anchor the period to a stable initial timestamp. That would start a three-year creation clock; the question instead requires a way to anchor retention to label application.

D:

Modification-time clocks can extend as the file changes. That would start retention from latest edit; the question instead requires a way to anchor retention to label application.

Question 332

An organization wants long-term preservation of financial records without scheduled deletion. Which Microsoft Purview approach should the administrator choose?

Apply longest-retention-wins precedence before honoring deletion.
Use retention-label disposition review.
Configure a delete-only retention action for eligible content.
Set an eligible retain-forever policy or retention label.

Explanation

Correct Answer

D:

Indefinite retention removes an automatic expiry time. It directly meets the case's requirement to preserve financial records indefinitely.

Incorrect Answers

A:

Preservation obligations override an earlier deletion trigger. That would avoid expiring a still-protected record; the question instead requires a way to preserve financial records indefinitely.

B:

Disposition review provides a controlled decision before eligible removal. That would approve expiry of regulated records; the question instead requires a way to preserve financial records indefinitely.

C:

Delete-only lifecycle settings remove content at the configured time absent overriding preservation. That would dispose of transient content by age; the question instead requires a way to preserve financial records indefinitely.

Question 333

A policy wants to delete transient collaboration content after an appropriate period and no other hold applies. Which action most directly satisfies this requirement?

Configure a delete-only retention action for eligible content.
Use retention-label disposition review.
Set an eligible retain-forever policy or retention label.
Apply longest-retention-wins precedence before honoring deletion.

Explanation

Correct Answer

A:

Delete-only lifecycle settings remove content at the configured time absent overriding preservation. It directly meets the case's requirement to dispose of transient content by age.

Incorrect Answers

B:

Disposition review provides a controlled decision before eligible removal. That would approve expiry of regulated records; the question instead requires a way to dispose of transient content by age.

C:

Indefinite retention removes an automatic expiry time. That would preserve financial records indefinitely; the question instead requires a way to dispose of transient content by age.

D:

Preservation obligations override an earlier deletion trigger. That would avoid expiring a still-protected record; the question instead requires a way to dispose of transient content by age.

Question 334

Legal wants an approval workflow before deleting individual expiring regulatory records. What is the most appropriate next action?

Apply longest-retention-wins precedence before honoring deletion.
Use retention-label disposition review.
Set an eligible retain-forever policy or retention label.
Configure a delete-only retention action for eligible content.

Explanation

Correct Answer

B:

Disposition review provides a controlled decision before eligible removal. It directly meets the case's requirement to approve expiry of regulated records.

Incorrect Answers

A:

Preservation obligations override an earlier deletion trigger. That would avoid expiring a still-protected record; the question instead requires a way to approve expiry of regulated records.

C:

Indefinite retention removes an automatic expiry time. That would preserve financial records indefinitely; the question instead requires a way to approve expiry of regulated records.

D:

Delete-only lifecycle settings remove content at the configured time absent overriding preservation. That would dispose of transient content by age; the question instead requires a way to approve expiry of regulated records.

Question 335

A record subject to a longer retention policy must not be deleted solely because an attached label expires sooner. Which response most directly addresses the stated need?

Set an eligible retain-forever policy or retention label.
Use retention-label disposition review.
Apply longest-retention-wins precedence before honoring deletion.
Configure a delete-only retention action for eligible content.

Explanation

Correct Answer

C:

Preservation obligations override an earlier deletion trigger. It directly meets the case's requirement to avoid expiring a still-protected record.

Incorrect Answers

A:

Indefinite retention removes an automatic expiry time. That would preserve financial records indefinitely; the question instead requires a way to avoid expiring a still-protected record.

B:

Disposition review provides a controlled decision before eligible removal. That would approve expiry of regulated records; the question instead requires a way to avoid expiring a still-protected record.

D:

Delete-only lifecycle settings remove content at the configured time absent overriding preservation. That would dispose of transient content by age; the question instead requires a way to avoid expiring a still-protected record.

Question 336

An employee resigns and then downloads an unusually large amount of sensitive SharePoint content before departure. Which configuration BEST meets the requirement?

Scope the Risky AI usage policy to selected supported indicators and in-scope users.
Use a Data leaks insider risk policy template.
Use the Data leaks by priority users policy template with the designated group.
Use the Insider Risk Management Data theft by departing users template.

Explanation

Correct Answer

D:

The departing-user template correlates exfiltration indicators with employment-exit context. It directly meets the case's requirement to detect potential departing-employee data theft.

Incorrect Answers

A:

Indicator and user scoping reduce unrelated surveillance while preserving eligible AI-risk signals in the configured policy. That would configure privacy-aware risky AI insider indicators; the question instead requires a way to detect potential departing-employee data theft.

B:

Data leaks policies evaluate relevant exfiltration activity for in-scope users. That would detect ongoing accidental or intentional leaks; the question instead requires a way to detect potential departing-employee data theft.

C:

Priority-user templates scope monitoring to configured high-impact users. That would prioritize sensitive users' leak events; the question instead requires a way to detect potential departing-employee data theft.

Question 337

A department experiences accidental external sharing by active staff without an HR departure trigger. Which Microsoft Purview approach should the administrator choose?

Use a Data leaks insider risk policy template.
Scope the Risky AI usage policy to selected supported indicators and in-scope users.
Use the Insider Risk Management Data theft by departing users template.
Use the Data leaks by priority users policy template with the designated group.

Explanation

Correct Answer

A:

Data leaks policies evaluate relevant exfiltration activity for in-scope users. It directly meets the case's requirement to detect ongoing accidental or intentional leaks.

Incorrect Answers

B:

Indicator and user scoping reduce unrelated surveillance while preserving eligible AI-risk signals in the configured policy. That would configure privacy-aware risky AI insider indicators; the question instead requires a way to detect ongoing accidental or intentional leaks.

C:

The departing-user template correlates exfiltration indicators with employment-exit context. That would detect potential departing-employee data theft; the question instead requires a way to detect ongoing accidental or intentional leaks.

D:

Priority-user templates scope monitoring to configured high-impact users. That would prioritize sensitive users' leak events; the question instead requires a way to detect ongoing accidental or intentional leaks.

Question 338

A select group of executives handles particularly valuable records and must be scored with priority group conditions. Which action most directly satisfies this requirement?

Use the Insider Risk Management Data theft by departing users template.
Use the Data leaks by priority users policy template with the designated group.
Use a Data leaks insider risk policy template.
Scope the Risky AI usage policy to selected supported indicators and in-scope users.

Explanation

Correct Answer

B:

Priority-user templates scope monitoring to configured high-impact users. It directly meets the case's requirement to prioritize sensitive users' leak events.

Incorrect Answers

A:

The departing-user template correlates exfiltration indicators with employment-exit context. That would detect potential departing-employee data theft; the question instead requires a way to prioritize sensitive users' leak events.

C:

Data leaks policies evaluate relevant exfiltration activity for in-scope users. That would detect ongoing accidental or intentional leaks; the question instead requires a way to prioritize sensitive users' leak events.

D:

Indicator and user scoping reduce unrelated surveillance while preserving eligible AI-risk signals in the configured policy. That would configure privacy-aware risky AI insider indicators; the question instead requires a way to prioritize sensitive users' leak events.

Question 339

An insider risk team needs to narrow an approved Risky AI usage policy to specific indicators and eligible employees. What is the most appropriate next action?

Use the Data leaks by priority users policy template with the designated group.
Use the Insider Risk Management Data theft by departing users template.
Scope the Risky AI usage policy to selected supported indicators and in-scope users.
Use a Data leaks insider risk policy template.

Explanation

Correct Answer

C:

Indicator and user scoping reduce unrelated surveillance while preserving eligible AI-risk signals in the configured policy. It directly meets the case's requirement to configure privacy-aware risky AI insider indicators.

Incorrect Answers

A:

Priority-user templates scope monitoring to configured high-impact users. That would prioritize sensitive users' leak events; the question instead requires a way to configure privacy-aware risky AI insider indicators.

B:

The departing-user template correlates exfiltration indicators with employment-exit context. That would detect potential departing-employee data theft; the question instead requires a way to configure privacy-aware risky AI insider indicators.

D:

Data leaks policies evaluate relevant exfiltration activity for in-scope users. That would detect ongoing accidental or intentional leaks; the question instead requires a way to configure privacy-aware risky AI insider indicators.

Question 340

An IRM policy needs resignation dates from the human resources system for employee departure correlation. Which response most directly addresses the stated need?

Check HR connector health, field mapping, and latest imports.
Configure the supported Entra account-deletion trigger option.
Limit connector fields and policy access to approved minimum-required data.
Configure an approved Insider Risk Management HR connector.

Explanation

Correct Answer

D:

HR connectors supply supported employee lifecycle events used by relevant policy templates. It directly meets the case's requirement to ingest resignation and termination dates.

Incorrect Answers

A:

Missing lifecycle data prevents an HR-dependent policy from correlating employment events. That would repair an absent HR trigger feed; the question instead requires a way to ingest resignation and termination dates.

B:

Certain departing-user workflows can use identity deletion as an exit signal. That would trigger on Entra account deletion; the question instead requires a way to ingest resignation and termination dates.

C:

Data minimization and role control reduce exposure of employee information. That would govern HR data collection for IRM; the question instead requires a way to ingest resignation and termination dates.

Pass Your Microsoft SC-401 Exam Easy!

Question 330

Explanation

Correct Answer

Incorrect Answers

Question 331

Explanation

Correct Answer

Incorrect Answers

Question 332

Explanation

Correct Answer

Incorrect Answers

Question 333

Explanation

Correct Answer

Incorrect Answers

Question 334

Explanation

Correct Answer

Incorrect Answers

Question 335

Explanation

Correct Answer

Incorrect Answers

Question 336

Explanation

Correct Answer

Incorrect Answers

Question 337

Explanation

Correct Answer

Incorrect Answers

Question 338

Explanation

Correct Answer

Incorrect Answers

Question 339

Explanation

Correct Answer

Incorrect Answers

Question 340

Explanation

Correct Answer

Incorrect Answers

Administering Information Security in Microsoft 365 (SC-401) Practice Tests