Pass Your Microsoft SC-401 Exam Easy!

Label activity trends summarize protection behavior across users. That would measure monthly labeling operations; the question instead requires a way to verify an individual file access.

The alert stores the policy match context for that blocked operation. That would identify the blocking DLP rule; the question instead requires a way to verify an individual file access.

eDiscovery locates preserved content rather than merely logging that it was accessed. That would retrieve invoice content evidence; the question instead requires a way to verify an individual file access.

The alert stores the policy match context for that blocked operation. That would identify the blocking DLP rule; the question instead requires a way to retrieve invoice content evidence.

Label activity trends summarize protection behavior across users. That would measure monthly labeling operations; the question instead requires a way to retrieve invoice content evidence.

Recorded audit events can link documented file access to users and timestamps. That would verify an individual file access; the question instead requires a way to retrieve invoice content evidence.

eDiscovery locates preserved content rather than merely logging that it was accessed. That would retrieve invoice content evidence; the question instead requires a way to measure monthly labeling operations.

The alert stores the policy match context for that blocked operation. That would identify the blocking DLP rule; the question instead requires a way to measure monthly labeling operations.

Recorded audit events can link documented file access to users and timestamps. That would verify an individual file access; the question instead requires a way to measure monthly labeling operations.

Recorded audit events can link documented file access to users and timestamps. That would verify an individual file access; the question instead requires a way to identify the blocking DLP rule.

Label activity trends summarize protection behavior across users. That would measure monthly labeling operations; the question instead requires a way to identify the blocking DLP rule.

eDiscovery locates preserved content rather than merely logging that it was accessed. That would retrieve invoice content evidence; the question instead requires a way to identify the blocking DLP rule.

Audit Premium provides extended retention for eligible users and events. That would validate an E5 audit duration; the question instead requires a way to correct overestimated Standard log retention.

New retention settings cannot restore events previously discarded. That would handle irreversible expired audit evidence; the question instead requires a way to correct overestimated Standard log retention.

Ten-year log retention is an entitlement plus policy configuration, not an automatic default. That would enable qualified long-term audit logs; the question instead requires a way to correct overestimated Standard log retention.

Ten-year log retention is an entitlement plus policy configuration, not an automatic default. That would enable qualified long-term audit logs; the question instead requires a way to validate an E5 audit duration.

Standard has shorter default retention than properly licensed Premium long-term options. That would correct overestimated Standard log retention; the question instead requires a way to validate an E5 audit duration.

New retention settings cannot restore events previously discarded. That would handle irreversible expired audit evidence; the question instead requires a way to validate an E5 audit duration.

Audit Premium provides extended retention for eligible users and events. That would validate an E5 audit duration; the question instead requires a way to enable qualified long-term audit logs.

New retention settings cannot restore events previously discarded. That would handle irreversible expired audit evidence; the question instead requires a way to enable qualified long-term audit logs.

Standard has shorter default retention than properly licensed Premium long-term options. That would correct overestimated Standard log retention; the question instead requires a way to enable qualified long-term audit logs.

Audit Premium provides extended retention for eligible users and events. That would validate an E5 audit duration; the question instead requires a way to handle irreversible expired audit evidence.

Standard has shorter default retention than properly licensed Premium long-term options. That would correct overestimated Standard log retention; the question instead requires a way to handle irreversible expired audit evidence.

Ten-year log retention is an entitlement plus policy configuration, not an automatic default. That would enable qualified long-term audit logs; the question instead requires a way to handle irreversible expired audit evidence.

Cloud Apps file-policy evidence describes matched connected-app files. That would investigate a third-party cloud file risk; the question instead requires a way to evaluate an insider behavior pattern.

DLP alerts tie content-based policy actions to specific transfer attempts. That would investigate an Exchange DLP violation; the question instead requires a way to evaluate an insider behavior pattern.

XDR incident correlation provides joined security-event context. That would investigate a cross-workload security incident; the question instead requires a way to evaluate an insider behavior pattern.

IRM correlates suspicious user activity patterns rather than only single DLP rule matches. That would evaluate an insider behavior pattern; the question instead requires a way to investigate an Exchange DLP violation.

XDR incident correlation provides joined security-event context. That would investigate a cross-workload security incident; the question instead requires a way to investigate an Exchange DLP violation.

Cloud Apps file-policy evidence describes matched connected-app files. That would investigate a third-party cloud file risk; the question instead requires a way to investigate an Exchange DLP violation.

IRM correlates suspicious user activity patterns rather than only single DLP rule matches. That would evaluate an insider behavior pattern; the question instead requires a way to investigate a third-party cloud file risk.

DLP alerts tie content-based policy actions to specific transfer attempts. That would investigate an Exchange DLP violation; the question instead requires a way to investigate a third-party cloud file risk.

XDR incident correlation provides joined security-event context. That would investigate a cross-workload security incident; the question instead requires a way to investigate a third-party cloud file risk.