Microsoft SC-401 Practice Test 5

Question 40

A classifier shows unexpected matches after a rule change; the engineer wants to know which evidence triggered it. Which response most directly addresses the stated need?

Use a test DLP policy or simulation with the custom SIT.
Define multiple confidence levels with appropriate evidence requirements.
Create carefully scoped custom patterns for each documented regional format.
Inspect matched evidence and configured proximity and confidence settings.

Explanation

Correct Answer

D:

The detector's constituent elements explain why a piece of content satisfied the SIT. It directly meets the case's requirement to troubleshoot a changed confidence result.

Incorrect Answers

A:

Testing classifies matching content while postponing enforcement until evidence is reviewed. That would pilot a custom sensitive-data detector; the question instead requires a way to troubleshoot a changed confidence result.

B:

SIT confidence levels can encode different degrees of corroboration. That would grade match certainty; the question instead requires a way to troubleshoot a changed confidence result.

C:

Explicit pattern variants reduce accidental omissions and overbroad generic matching. That would support controlled regional formats; the question instead requires a way to troubleshoot a changed confidence result.

Question 41

A hospital inventory records structured patient-account numbers that must be matched only to active patients. Which configuration BEST meets the requirement?

Use an EDM sensitive information type backed by the current patient reference data.
Evaluate a trained or built-in semantic classifier for that content category.
Evaluate the corresponding built-in sensitive information type and match confidence.
Use document fingerprinting based on the approved employment agreement template.

Explanation

Correct Answer

A:

EDM validates values against a maintained reference rather than treating all formatted strings as patients. It directly meets the case's requirement to detect registered active patient accounts.

Incorrect Answers

B:

Learned classifiers recognize content themes beyond strict numeric patterns. That would detect a semantic content category; the question instead requires a way to detect registered active patient accounts.

C:

Built-in SITs cover standardized data formats when supported by the catalog. That would detect a standard financial identifier; the question instead requires a way to detect registered active patient accounts.

D:

A document fingerprint captures form-level text similarities across filled templates. That would detect document-template resemblance; the question instead requires a way to detect registered active patient accounts.

Question 42

Legal needs to find employment agreements sharing characteristic sections, despite different personal details. Which Microsoft Purview approach should the administrator choose?

Evaluate a trained or built-in semantic classifier for that content category.
Use document fingerprinting based on the approved employment agreement template.
Use an EDM sensitive information type backed by the current patient reference data.
Evaluate the corresponding built-in sensitive information type and match confidence.

Explanation

Correct Answer

B:

A document fingerprint captures form-level text similarities across filled templates. It directly meets the case's requirement to detect document-template resemblance.

Incorrect Answers

A:

Learned classifiers recognize content themes beyond strict numeric patterns. That would detect a semantic content category; the question instead requires a way to detect document-template resemblance.

C:

EDM validates values against a maintained reference rather than treating all formatted strings as patients. That would detect registered active patient accounts; the question instead requires a way to detect document-template resemblance.

D:

Built-in SITs cover standardized data formats when supported by the catalog. That would detect a standard financial identifier; the question instead requires a way to detect document-template resemblance.

Question 43

Security must find unstructured bullying complaints written in many styles without standard identifiers. Which action most directly satisfies this requirement?

Use an EDM sensitive information type backed by the current patient reference data.
Use document fingerprinting based on the approved employment agreement template.
Evaluate a trained or built-in semantic classifier for that content category.
Evaluate the corresponding built-in sensitive information type and match confidence.

Explanation

Correct Answer

C:

Learned classifiers recognize content themes beyond strict numeric patterns. It directly meets the case's requirement to detect a semantic content category.

Incorrect Answers

A:

EDM validates values against a maintained reference rather than treating all formatted strings as patients. That would detect registered active patient accounts; the question instead requires a way to detect a semantic content category.

B:

A document fingerprint captures form-level text similarities across filled templates. That would detect document-template resemblance; the question instead requires a way to detect a semantic content category.

D:

Built-in SITs cover standardized data formats when supported by the catalog. That would detect a standard financial identifier; the question instead requires a way to detect a semantic content category.

Question 44

Finance wants detection of an internationally recognized bank-account identifier pattern with supplied confidence evidence. What is the most appropriate next action?

Evaluate a trained or built-in semantic classifier for that content category.
Use document fingerprinting based on the approved employment agreement template.
Use an EDM sensitive information type backed by the current patient reference data.
Evaluate the corresponding built-in sensitive information type and match confidence.

Explanation

Correct Answer

D:

Built-in SITs cover standardized data formats when supported by the catalog. It directly meets the case's requirement to detect a standard financial identifier.

Incorrect Answers

A:

Learned classifiers recognize content themes beyond strict numeric patterns. That would detect a semantic content category; the question instead requires a way to detect a standard financial identifier.

B:

A document fingerprint captures form-level text similarities across filled templates. That would detect document-template resemblance; the question instead requires a way to detect a standard financial identifier.

C:

EDM validates values against a maintained reference rather than treating all formatted strings as patients. That would detect registered active patient accounts; the question instead requires a way to detect a standard financial identifier.

Question 45

A governance team wants a cross-tenant chart of files carrying Confidential labels rather than an investigator opening their contents. Which response most directly addresses the stated need?

Use aggregate Data explorer classification reporting.
Review matching items through Content explorer with the required permissions.
Open the relevant Purview alert and investigation record.
Review Endpoint DLP activity records in Activity explorer.

Explanation

Correct Answer

A:

Data explorer summarizes categorized data for coverage assessment. It directly meets the case's requirement to report label inventory trends.

Incorrect Answers

B:

Content explorer provides classified item drill-down for authorized reviewers. That would identify files behind a sensitive-data match; the question instead requires a way to report label inventory trends.

C:

An alert contextualizes triggered conditions, affected actors, and investigation status. That would follow an individual exfiltration alert; the question instead requires a way to report label inventory trends.

D:

Endpoint activity telemetry shows supported operations associated with protected content. That would investigate user actions on endpoints; the question instead requires a way to report label inventory trends.

Question 46

A permitted security reviewer must inspect which particular files contained national identifiers in a SharePoint location. Which configuration BEST meets the requirement?

Use aggregate Data explorer classification reporting.
Review matching items through Content explorer with the required permissions.
Open the relevant Purview alert and investigation record.
Review Endpoint DLP activity records in Activity explorer.

Explanation

Correct Answer

B:

Content explorer provides classified item drill-down for authorized reviewers. It directly meets the case's requirement to identify files behind a sensitive-data match.

Incorrect Answers

A:

Data explorer summarizes categorized data for coverage assessment. That would report label inventory trends; the question instead requires a way to identify files behind a sensitive-data match.

C:

An alert contextualizes triggered conditions, affected actors, and investigation status. That would follow an individual exfiltration alert; the question instead requires a way to identify files behind a sensitive-data match.

D:

Endpoint activity telemetry shows supported operations associated with protected content. That would investigate user actions on endpoints; the question instead requires a way to identify files behind a sensitive-data match.

Question 47

A policy owner asks which users recently copied or printed sensitive information on managed endpoints. Which Microsoft Purview approach should the administrator choose?

Open the relevant Purview alert and investigation record.
Review matching items through Content explorer with the required permissions.
Review Endpoint DLP activity records in Activity explorer.
Use aggregate Data explorer classification reporting.

Explanation

Correct Answer

C:

Endpoint activity telemetry shows supported operations associated with protected content. It directly meets the case's requirement to investigate user actions on endpoints.

Incorrect Answers

A:

An alert contextualizes triggered conditions, affected actors, and investigation status. That would follow an individual exfiltration alert; the question instead requires a way to investigate user actions on endpoints.

B:

Content explorer provides classified item drill-down for authorized reviewers. That would identify files behind a sensitive-data match; the question instead requires a way to investigate user actions on endpoints.

D:

Data explorer summarizes categorized data for coverage assessment. That would report label inventory trends; the question instead requires a way to investigate user actions on endpoints.

Question 48

An investigator needs the life cycle and evidence of a high severity exfiltration event. Which action most directly satisfies this requirement?

Review Endpoint DLP activity records in Activity explorer.
Use aggregate Data explorer classification reporting.
Review matching items through Content explorer with the required permissions.
Open the relevant Purview alert and investigation record.

Explanation

Correct Answer

D:

An alert contextualizes triggered conditions, affected actors, and investigation status. It directly meets the case's requirement to follow an individual exfiltration alert.

Incorrect Answers

A:

Endpoint activity telemetry shows supported operations associated with protected content. That would investigate user actions on endpoints; the question instead requires a way to follow an individual exfiltration alert.

B:

Data explorer summarizes categorized data for coverage assessment. That would report label inventory trends; the question instead requires a way to follow an individual exfiltration alert.

C:

Content explorer provides classified item drill-down for authorized reviewers. That would identify files behind a sensitive-data match; the question instead requires a way to follow an individual exfiltration alert.

Question 49

Procurement receives identical purchase-order templates, but every new supplier provides different filled-in amounts. What is the most appropriate next action?

Create a fingerprint detector from the standard purchase-order form.
Build a custom SIT with primary identifier expression and supporting supplier term.
Deploy an EDM SIT using the current approved customer data table.
Choose an applicable built-in financial SIT after validating coverage.

Explanation

Correct Answer

A:

Form fingerprints detect reusable layout text despite dynamic field values when partial matching is configured. It directly meets the case's requirement to recognize recurring purchase-order forms.

Incorrect Answers

B:

Combining expression and business evidence limits generic number collisions. That would recognize bespoke purchase identifiers; the question instead requires a way to recognize recurring purchase-order forms.

C:

Exact-data comparison checks membership in source values after hashing. That would distinguish actual accounts from plausible numbers; the question instead requires a way to recognize recurring purchase-order forms.

D:

Predefined financial classifiers implement widely used pattern checks for supported formats. That would identify standardized financial data; the question instead requires a way to recognize recurring purchase-order forms.

Question 50

An invoice source uses a unique purchase-order identifier prefix plus surrounding supplier reference text. Which response most directly addresses the stated need?

Choose an applicable built-in financial SIT after validating coverage.
Build a custom SIT with primary identifier expression and supporting supplier term.
Create a fingerprint detector from the standard purchase-order form.
Deploy an EDM SIT using the current approved customer data table.

Explanation

Correct Answer

B:

Combining expression and business evidence limits generic number collisions. It directly meets the case's requirement to recognize bespoke purchase identifiers.

Incorrect Answers

A:

Predefined financial classifiers implement widely used pattern checks for supported formats. That would identify standardized financial data; the question instead requires a way to recognize bespoke purchase identifiers.

C:

Form fingerprints detect reusable layout text despite dynamic field values when partial matching is configured. That would recognize recurring purchase-order forms; the question instead requires a way to recognize bespoke purchase identifiers.

D:

Exact-data comparison checks membership in source values after hashing. That would distinguish actual accounts from plausible numbers; the question instead requires a way to recognize bespoke purchase identifiers.

Pass Your Microsoft SC-401 Exam Easy!

Question 40

Explanation

Correct Answer

Incorrect Answers

Question 41

Explanation

Correct Answer

Incorrect Answers

Question 42

Explanation

Correct Answer

Incorrect Answers

Question 43

Explanation

Correct Answer

Incorrect Answers

Question 44

Explanation

Correct Answer

Incorrect Answers

Question 45

Explanation

Correct Answer

Incorrect Answers

Question 46

Explanation

Correct Answer

Incorrect Answers

Question 47

Explanation

Correct Answer

Incorrect Answers

Question 48

Explanation

Correct Answer

Incorrect Answers

Question 49

Explanation

Correct Answer

Incorrect Answers

Question 50

Explanation

Correct Answer

Incorrect Answers

Administering Information Security in Microsoft 365 (SC-401) Practice Tests