Microsoft SC-401 Practice Test 40

Question 390

A new analyst should view case details but not change risk scoring settings. Which response most directly addresses the stated need?

Complete the documented dual authorization and scoped setup process.
Assign a suitable IRM investigation role with minimal configuration rights.
Inspect relevant administrative audit activities.
Review and maintain the default pseudonymous-username privacy setting.

Explanation

Correct Answer

Distinct IRM roles restrict policy management separately from case review. It directly meets the case's requirement to separate investigation from administration.

Incorrect Answers

Opt-in forensic evidence demands additional permission safeguards. That would authorize sensitive evidence capture; the question instead requires a way to separate investigation from administration.

Supported IRM administration changes can be reviewed through audit records. That would audit insider policy modifications; the question instead requires a way to separate investigation from administration.

Default IRM pseudonymization reduces unnecessary identity exposure. That would protect identity in ordinary alert review; the question instead requires a way to separate investigation from administration.

Question 391

A forensic evidence pilot requires oversight from both operational and privacy stakeholders. Which configuration BEST meets the requirement?

Inspect relevant administrative audit activities.
Review and maintain the default pseudonymous-username privacy setting.
Complete the documented dual authorization and scoped setup process.
Assign a suitable IRM investigation role with minimal configuration rights.

Explanation

Correct Answer

Opt-in forensic evidence demands additional permission safeguards. It directly meets the case's requirement to authorize sensitive evidence capture.

Incorrect Answers

Supported IRM administration changes can be reviewed through audit records. That would audit insider policy modifications; the question instead requires a way to authorize sensitive evidence capture.

Default IRM pseudonymization reduces unnecessary identity exposure. That would protect identity in ordinary alert review; the question instead requires a way to authorize sensitive evidence capture.

Distinct IRM roles restrict policy management separately from case review. That would separate investigation from administration; the question instead requires a way to authorize sensitive evidence capture.

Question 392

A company wants to stop an outbound email containing customer account numbers at send time. Which Microsoft Purview approach should the administrator choose?

Use Insider Risk Management cases and controlled investigation roles.
Create an appropriate Insider Risk Management policy using activity indicators.
Use Adaptive Protection to link risk levels to eligible Endpoint DLP rules.
Configure a blocking Exchange DLP policy.

Explanation

Correct Answer

DLP applies inline content-based restrictions to eligible outgoing mail. It directly meets the case's requirement to block current email exfiltration.

Incorrect Answers

Case management organizes findings after IRM detection. That would conduct a formal insider case review; the question instead requires a way to block current email exfiltration.

IRM correlates risk signals and trends rather than merely enforcing one transfer rule. That would score extended insider activity; the question instead requires a way to block current email exfiltration.

Risk-level conditions connect IRM analysis with adaptive DLP enforcement. That would dynamically tighten device controls; the question instead requires a way to block current email exfiltration.

Question 393

The SOC wants to identify an employee pattern of suspicious downloads and copying over several weeks. Which action most directly satisfies this requirement?

Create an appropriate Insider Risk Management policy using activity indicators.
Configure a blocking Exchange DLP policy.
Use Adaptive Protection to link risk levels to eligible Endpoint DLP rules.
Use Insider Risk Management cases and controlled investigation roles.

Explanation

Correct Answer

IRM correlates risk signals and trends rather than merely enforcing one transfer rule. It directly meets the case's requirement to score extended insider activity.

Incorrect Answers

DLP applies inline content-based restrictions to eligible outgoing mail. That would block current email exfiltration; the question instead requires a way to score extended insider activity.

Risk-level conditions connect IRM analysis with adaptive DLP enforcement. That would dynamically tighten device controls; the question instead requires a way to score extended insider activity.

Case management organizes findings after IRM detection. That would conduct a formal insider case review; the question instead requires a way to score extended insider activity.

Question 394

Senior leadership wants risk-based endpoint controls that tighten when an employee's insider score rises. What is the most appropriate next action?

Configure a blocking Exchange DLP policy.
Use Adaptive Protection to link risk levels to eligible Endpoint DLP rules.
Use Insider Risk Management cases and controlled investigation roles.
Create an appropriate Insider Risk Management policy using activity indicators.

Explanation

Correct Answer

Risk-level conditions connect IRM analysis with adaptive DLP enforcement. It directly meets the case's requirement to dynamically tighten device controls.

Incorrect Answers

DLP applies inline content-based restrictions to eligible outgoing mail. That would block current email exfiltration; the question instead requires a way to dynamically tighten device controls.

Case management organizes findings after IRM detection. That would conduct a formal insider case review; the question instead requires a way to dynamically tighten device controls.

IRM correlates risk signals and trends rather than merely enforcing one transfer rule. That would score extended insider activity; the question instead requires a way to dynamically tighten device controls.

Question 395

A compliance team wants to inspect an escalated employee risk case and supporting events. Which response most directly addresses the stated need?

Use Adaptive Protection to link risk levels to eligible Endpoint DLP rules.
Create an appropriate Insider Risk Management policy using activity indicators.
Use Insider Risk Management cases and controlled investigation roles.
Configure a blocking Exchange DLP policy.

Explanation

Correct Answer

Case management organizes findings after IRM detection. It directly meets the case's requirement to conduct a formal insider case review.

Incorrect Answers

Risk-level conditions connect IRM analysis with adaptive DLP enforcement. That would dynamically tighten device controls; the question instead requires a way to conduct a formal insider case review.

IRM correlates risk signals and trends rather than merely enforcing one transfer rule. That would score extended insider activity; the question instead requires a way to conduct a formal insider case review.

DLP applies inline content-based restrictions to eligible outgoing mail. That would block current email exfiltration; the question instead requires a way to conduct a formal insider case review.

Question 396

An investigator needs to discover which user deleted a particular SharePoint file during a suspected leak. Which configuration BEST meets the requirement?

Perform a scoped eDiscovery content search across the relevant mailboxes.
Analyze eligible labeling operations in Activity explorer or audit reporting.
Filter Purview Audit search by user, activity, and UTC date range.
Search Microsoft Purview Audit for the relevant file operation and time range.

Explanation

Correct Answer

Audit searches return recorded activities associated with users, resources, and workloads. It directly meets the case's requirement to identify a SharePoint deletion actor.

Incorrect Answers

eDiscovery locates content items rather than merely recording operations performed on them. That would find case-related mailbox content; the question instead requires a way to identify a SharePoint deletion actor.

Classification activity reporting highlights label usage trends and events. That would analyze label-application activity; the question instead requires a way to identify a SharePoint deletion actor.

Scoped audit queries isolate relevant user actions within their recorded period. That would reconstruct one user's download timeline; the question instead requires a way to identify a SharePoint deletion actor.

Question 397

A security team wants to review a sequence of file downloads by one named employee over a defined week. Which Microsoft Purview approach should the administrator choose?

Filter Purview Audit search by user, activity, and UTC date range.
Search Microsoft Purview Audit for the relevant file operation and time range.
Perform a scoped eDiscovery content search across the relevant mailboxes.
Analyze eligible labeling operations in Activity explorer or audit reporting.

Explanation

Correct Answer

Scoped audit queries isolate relevant user actions within their recorded period. It directly meets the case's requirement to reconstruct one user's download timeline.

Incorrect Answers

Audit searches return recorded activities associated with users, resources, and workloads. That would identify a SharePoint deletion actor; the question instead requires a way to reconstruct one user's download timeline.

Classification activity reporting highlights label usage trends and events. That would analyze label-application activity; the question instead requires a way to reconstruct one user's download timeline.

Question 398

A manager asks how many users are applying sensitivity labels, not who deleted a specific file. Which action most directly satisfies this requirement?

Perform a scoped eDiscovery content search across the relevant mailboxes.
Analyze eligible labeling operations in Activity explorer or audit reporting.
Filter Purview Audit search by user, activity, and UTC date range.
Search Microsoft Purview Audit for the relevant file operation and time range.

Explanation

Correct Answer

Classification activity reporting highlights label usage trends and events. It directly meets the case's requirement to analyze label-application activity.

Incorrect Answers

Scoped audit queries isolate relevant user actions within their recorded period. That would reconstruct one user's download timeline; the question instead requires a way to analyze label-application activity.

Question 399

A compliance specialist needs documents containing case-related keywords across employee mailboxes, not activity event records. What is the most appropriate next action?

Filter Purview Audit search by user, activity, and UTC date range.
Analyze eligible labeling operations in Activity explorer or audit reporting.
Perform a scoped eDiscovery content search across the relevant mailboxes.
Search Microsoft Purview Audit for the relevant file operation and time range.

Explanation

Correct Answer

eDiscovery locates content items rather than merely recording operations performed on them. It directly meets the case's requirement to find case-related mailbox content.

Incorrect Answers

Scoped audit queries isolate relevant user actions within their recorded period. That would reconstruct one user's download timeline; the question instead requires a way to find case-related mailbox content.

Classification activity reporting highlights label usage trends and events. That would analyze label-application activity; the question instead requires a way to find case-related mailbox content.

Question 400

A responder must search audit records but may not change retention policies or global tenant settings. Which response most directly addresses the stated need?

Give the employee appropriate Purview audit permissions.
Search supported administrative audit events for role or policy changes.
Assign a suitable Audit Manager role group.
Assign the View-Only Audit Logs or appropriate Audit Reader permission.

Explanation

Correct Answer

Audit reader roles grant investigative log search without unrelated configuration rights. It directly meets the case's requirement to delegate audit search privileges.

Incorrect Answers

SharePoint site administration alone does not grant tenant-wide audit search rights. That would fix an audit permission gap; the question instead requires a way to delegate audit search privileges.

Relevant administrative events provide traceability for governance changes. That would audit privileged policy changes; the question instead requires a way to delegate audit search privileges.

Purview audit roles separate responsibilities according to the authorized task. That would grant permitted audit management; the question instead requires a way to delegate audit search privileges.

Administering Information Security in Microsoft 365 (SC-401) Practice Tests

Microsoft SC-401 Practice Test 38 - 10 Questions (Last Reviewed 27-Sep-2026)
Microsoft SC-401 Practice Test 39 - 10 Questions (Last Reviewed 26-Sep-2026)
Microsoft SC-401 Practice Test 40 - 10 Questions (Last Reviewed 25-Sep-2026)
Microsoft SC-401 Practice Test 41 - 10 Questions (Last Reviewed 24-Sep-2026)
Microsoft SC-401 Practice Test 42 - 10 Questions (Last Reviewed 23-Sep-2026)

Pass Your Microsoft SC-401 Exam Easy!

Question 390

Explanation

Correct Answer

Incorrect Answers

Question 391

Explanation

Correct Answer

Incorrect Answers

Question 392

Explanation

Correct Answer

Incorrect Answers

Question 393

Explanation

Correct Answer

Incorrect Answers

Question 394

Explanation

Correct Answer

Incorrect Answers

Question 395

Explanation

Correct Answer

Incorrect Answers

Question 396

Explanation

Correct Answer

Incorrect Answers

Question 397

Explanation

Correct Answer

Incorrect Answers

Question 398

Explanation

Correct Answer

Incorrect Answers

Question 399

Explanation

Correct Answer

Incorrect Answers

Question 400

Explanation

Correct Answer

Incorrect Answers

Administering Information Security in Microsoft 365 (SC-401) Practice Tests