Microsoft SC-401 Practice Test 9

Question 80

An administrator wants automatic labeling of supported emails in Exchange Online based on SIT matches. Which response most directly addresses the stated need?

Run the service-side auto-labeling policy in simulation.
Create a service-side auto-labeling policy for that SharePoint location.
Configure a sensitivity label's client-side recommendation rule.
Scope a service-side auto-labeling policy to Exchange and its supported conditions.

Explanation

Correct Answer

D:

Location-scoped automatic labeling can process supported email in transit based on policy criteria. It directly meets the case's requirement to label email by service-side conditions.

Incorrect Answers

A:

Simulation evaluates matches and potential impact before applying labels to production items. That would test service-side labeling impact; the question instead requires a way to label email by service-side conditions.

B:

Service-side auto-labeling evaluates selected locations without requiring users to open the content. That would label files at rest in SharePoint; the question instead requires a way to label email by service-side conditions.

C:

Office client-side labeling can recommend a label during creation or editing when supported conditions match. That would prompt an author with a label recommendation; the question instead requires a way to label email by service-side conditions.

Question 81

Employees manually choose a Highly Confidential label; a lower-priority automatic policy must not silently downgrade it. Which configuration BEST meets the requirement?

Preserve the higher-priority manually applied label.
Align the label's file, email, or container scope with the content being labeled.
Enable the supported override option for manually labeled lower-priority content.
Configure eligible auto-labeling to apply the higher-priority label.

Explanation

Correct Answer

A:

Auto-labeling rules honor label precedence and do not replace a higher-priority manual classification. It directly meets the case's requirement to prevent automatic downgrades.

Incorrect Answers

B:

Label scope controls where the label and its settings may apply. That would prevent inappropriate label scope assignment; the question instead requires a way to prevent automatic downgrades.

C:

Service-side override of manual labels is configurable and not generally the default. That would explicitly allow an automated higher-priority override; the question instead requires a way to prevent automatic downgrades.

D:

Automatic labeling can replace lower-priority default or auto-applied labels when its conditions permit. That would upgrade a low-priority default classification; the question instead requires a way to prevent automatic downgrades.

Question 82

A low-priority default label has been applied, but supported content now matches a higher-priority automatic rule. Which Microsoft Purview approach should the administrator choose?

Enable the supported override option for manually labeled lower-priority content.
Configure eligible auto-labeling to apply the higher-priority label.
Align the label's file, email, or container scope with the content being labeled.
Preserve the higher-priority manually applied label.

Explanation

Correct Answer

B:

Automatic labeling can replace lower-priority default or auto-applied labels when its conditions permit. It directly meets the case's requirement to upgrade a low-priority default classification.

Incorrect Answers

A:

Service-side override of manual labels is configurable and not generally the default. That would explicitly allow an automated higher-priority override; the question instead requires a way to upgrade a low-priority default classification.

C:

Label scope controls where the label and its settings may apply. That would prevent inappropriate label scope assignment; the question instead requires a way to upgrade a low-priority default classification.

D:

Auto-labeling rules honor label precedence and do not replace a higher-priority manual classification. That would prevent automatic downgrades; the question instead requires a way to upgrade a low-priority default classification.

Question 83

A service-side policy needs to replace a manually selected lower-priority label, subject to explicit organizational permission. Which action most directly satisfies this requirement?

Configure eligible auto-labeling to apply the higher-priority label.
Preserve the higher-priority manually applied label.
Enable the supported override option for manually labeled lower-priority content.
Align the label's file, email, or container scope with the content being labeled.

Explanation

Correct Answer

C:

Service-side override of manual labels is configurable and not generally the default. It directly meets the case's requirement to explicitly allow an automated higher-priority override.

Incorrect Answers

A:

Automatic labeling can replace lower-priority default or auto-applied labels when its conditions permit. That would upgrade a low-priority default classification; the question instead requires a way to explicitly allow an automated higher-priority override.

B:

Auto-labeling rules honor label precedence and do not replace a higher-priority manual classification. That would prevent automatic downgrades; the question instead requires a way to explicitly allow an automated higher-priority override.

D:

Label scope controls where the label and its settings may apply. That would prevent inappropriate label scope assignment; the question instead requires a way to explicitly allow an automated higher-priority override.

Question 84

A sensitivity policy must never substitute a label that does not apply to the object's scope. What is the most appropriate next action?

Preserve the higher-priority manually applied label.
Configure eligible auto-labeling to apply the higher-priority label.
Enable the supported override option for manually labeled lower-priority content.
Align the label's file, email, or container scope with the content being labeled.

Explanation

Correct Answer

D:

Label scope controls where the label and its settings may apply. It directly meets the case's requirement to prevent inappropriate label scope assignment.

Incorrect Answers

A:

Auto-labeling rules honor label precedence and do not replace a higher-priority manual classification. That would prevent automatic downgrades; the question instead requires a way to prevent inappropriate label scope assignment.

B:

Automatic labeling can replace lower-priority default or auto-applied labels when its conditions permit. That would upgrade a low-priority default classification; the question instead requires a way to prevent inappropriate label scope assignment.

C:

Service-side override of manual labels is configurable and not generally the default. That would explicitly allow an automated higher-priority override; the question instead requires a way to prevent inappropriate label scope assignment.

Question 85

A new Teams workspace for outside consultants should prohibit unmanaged external sharing by configuration. Which response most directly addresses the stated need?

Apply a Teams or group container sensitivity label with supported sharing controls.
Manage actual file access through SharePoint or Teams permissions in addition to labeling.
Configure separate file-level labeling and protection rather than relying on the container label.
Use an appropriately configured site or group sensitivity label.

Explanation

Correct Answer

A:

Container label settings can govern collaboration boundaries for the associated team and site. It directly meets the case's requirement to enforce team-level sharing restrictions.

Incorrect Answers

B:

Site permissions determine content authorization independently of label classification controls. That would separate container classification from file access; the question instead requires a way to enforce team-level sharing restrictions.

C:

Container label settings do not automatically encrypt each document merely because the site or Team is labeled. That would protect files independently of a container; the question instead requires a way to enforce team-level sharing restrictions.

D:

Site and group labels can apply supported privacy and external-sharing settings. That would apply site privacy settings; the question instead requires a way to enforce team-level sharing restrictions.

Question 86

SharePoint administrators need to set the privacy and guest-access posture of a project site through classification. Which configuration BEST meets the requirement?

Configure separate file-level labeling and protection rather than relying on the container label.
Use an appropriately configured site or group sensitivity label.
Manage actual file access through SharePoint or Teams permissions in addition to labeling.
Apply a Teams or group container sensitivity label with supported sharing controls.

Explanation

Correct Answer

B:

Site and group labels can apply supported privacy and external-sharing settings. It directly meets the case's requirement to apply site privacy settings.

Incorrect Answers

A:

Container label settings do not automatically encrypt each document merely because the site or Team is labeled. That would protect files independently of a container; the question instead requires a way to apply site privacy settings.

C:

Site permissions determine content authorization independently of label classification controls. That would separate container classification from file access; the question instead requires a way to apply site privacy settings.

D:

Container label settings can govern collaboration boundaries for the associated team and site. That would enforce team-level sharing restrictions; the question instead requires a way to apply site privacy settings.

Question 87

A manager expects a label on the Team to encrypt every Word document stored in its channel automatically. Which Microsoft Purview approach should the administrator choose?

Apply a Teams or group container sensitivity label with supported sharing controls.
Use an appropriately configured site or group sensitivity label.
Configure separate file-level labeling and protection rather than relying on the container label.
Manage actual file access through SharePoint or Teams permissions in addition to labeling.

Explanation

Correct Answer

C:

Container label settings do not automatically encrypt each document merely because the site or Team is labeled. It directly meets the case's requirement to protect files independently of a container.

Incorrect Answers

A:

Container label settings can govern collaboration boundaries for the associated team and site. That would enforce team-level sharing restrictions; the question instead requires a way to protect files independently of a container.

B:

Site and group labels can apply supported privacy and external-sharing settings. That would apply site privacy settings; the question instead requires a way to protect files independently of a container.

D:

Site permissions determine content authorization independently of label classification controls. That would separate container classification from file access; the question instead requires a way to protect files independently of a container.

Question 88

A team label applies to its collaboration container but must not grant users file permissions by itself. Which action most directly satisfies this requirement?

Apply a Teams or group container sensitivity label with supported sharing controls.
Configure separate file-level labeling and protection rather than relying on the container label.
Use an appropriately configured site or group sensitivity label.
Manage actual file access through SharePoint or Teams permissions in addition to labeling.

Explanation

Correct Answer

D:

Site permissions determine content authorization independently of label classification controls. It directly meets the case's requirement to separate container classification from file access.

Incorrect Answers

A:

Container label settings can govern collaboration boundaries for the associated team and site. That would enforce team-level sharing restrictions; the question instead requires a way to separate container classification from file access.

B:

Container label settings do not automatically encrypt each document merely because the site or Team is labeled. That would protect files independently of a container; the question instead requires a way to separate container classification from file access.

C:

Site and group labels can apply supported privacy and external-sharing settings. That would apply site privacy settings; the question instead requires a way to separate container classification from file access.

Question 89

An employee must author new sensitivity label definitions but should not receive general tenant-wide administrator rights. What is the most appropriate next action?

Assign an appropriate least-privilege information protection administration role.
Assign scoped audit or investigation read permissions instead of label policy management.
Grant suitable label policy management permissions and target a scoped publication policy.
Separate information protection management roles from content explorer viewer permissions.

Explanation

Correct Answer

A:

Purview role groups can delegate label configuration without global administrator privileges. It directly meets the case's requirement to delegate label creation safely.

Incorrect Answers

B:

Investigation and policy-authoring permissions are separately delegated capabilities. That would permit label investigation without policy editing; the question instead requires a way to delegate label creation safely.

C:

Label publishing is separately controlled and can be targeted to selected users. That would delegate audience-scoped label publication; the question instead requires a way to delegate label creation safely.

D:

Content investigation does not require the authority to create or change protection policies. That would maintain role separation for labels; the question instead requires a way to delegate label creation safely.

Question 90

An auditor must review which users applied labels without being allowed to edit protection policy. Which response most directly addresses the stated need?

Grant suitable label policy management permissions and target a scoped publication policy.
Assign scoped audit or investigation read permissions instead of label policy management.
Separate information protection management roles from content explorer viewer permissions.
Assign an appropriate least-privilege information protection administration role.

Explanation

Correct Answer

B:

Investigation and policy-authoring permissions are separately delegated capabilities. It directly meets the case's requirement to permit label investigation without policy editing.

Incorrect Answers

A:

Label publishing is separately controlled and can be targeted to selected users. That would delegate audience-scoped label publication; the question instead requires a way to permit label investigation without policy editing.

C:

Content investigation does not require the authority to create or change protection policies. That would maintain role separation for labels; the question instead requires a way to permit label investigation without policy editing.

D:

Purview role groups can delegate label configuration without global administrator privileges. That would delegate label creation safely; the question instead requires a way to permit label investigation without policy editing.

Pass Your Microsoft SC-401 Exam Easy!

Question 80

Explanation

Correct Answer

Incorrect Answers

Question 81

Explanation

Correct Answer

Incorrect Answers

Question 82

Explanation

Correct Answer

Incorrect Answers

Question 83

Explanation

Correct Answer

Incorrect Answers

Question 84

Explanation

Correct Answer

Incorrect Answers

Question 85

Explanation

Correct Answer

Incorrect Answers

Question 86

Explanation

Correct Answer

Incorrect Answers

Question 87

Explanation

Correct Answer

Incorrect Answers

Question 88

Explanation

Correct Answer

Incorrect Answers

Question 89

Explanation

Correct Answer

Incorrect Answers

Question 90

Explanation

Correct Answer

Incorrect Answers

Administering Information Security in Microsoft 365 (SC-401) Practice Tests