SC-401: Administering Information Security in Microsoft 365Demo

You have a Microsoft 365 E5 subscription that includes a Microsoft SharePoint Online site named Site1.

You need to deploy a Microsoft Purview insider risk management solution that generates an alert when users share sensitive information from Site1 with external recipients.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct answer is worth one point.

You have Microsoft 365 E5 subscriptions.

You deploy Microsoft Purview Data Security Posture Management for AI (DSPM for AI).

You need to modify the default policies created during the deployment.

Which two Microsoft Purview solutions should you use? Each correct answer presents part of the solution.

> NOTE: Each correct selection is worth one point.

HOTSPOT

You have a Microsoft 365 E5 tenant that contains the objects in the following table.

You need to restore a Microsoft Word document deleted from the Sales channel by User1.

From where can the document be restored, and for how long is it retained if it is not restored?

You have a Microsoft 365 E5 subscription that includes a device named Device1.

You need to enable Endpoint data loss prevention (Endpoint DLP) for Device1.

What should you do first in the Microsoft Purview portal?

You have a Microsoft 365 E5 tenant that uses Microsoft Teams and includes two users named User1 and User2.

You create a data loss prevention (DLP) policy that applies to the Teams chat and channel messages location for User1 and User2.

Which Teams entities will receive DLP protection?

You have a Microsoft 365 subscription that includes 100 users and a Microsoft 365 group named Group1.

All users have Windows 11 devices and use Microsoft SharePoint Online and Exchange Online.

A sensitivity label named Label1 is published as the default label for Group1.

You add two sublabels, Sublabel1 and Sublabel2, to Label1.

You need to ensure that the settings in Sublabel1 are applied by default to Group1.

What should you do?

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps.

You need to make sure that you receive an alert when a user uploads a document to a third-party cloud storage service.

What should you use?

Solution: In the Microsoft 365 Endpoint data loss prevention (Endpoint DLP) settings, add a folder path to the file path exclusions.

Does this achieve the goal?

Solution: Create an app discovery policy in Microsoft Defender for Cloud Apps.

Does this solution meet the goal?

Solution: In Microsoft Defender for Cloud Apps, mark the application as Unsanctioned.

Does this meet the goal?

You plan to implement Microsoft 365 Endpoint data loss prevention (Endpoint DLP).

You need to determine which end-user activities can be audited on endpoints and which can be restricted on endpoints.

What should you identify for each activity?

You create a label that encrypts email data.

Users report that they cannot use the label in Outlook on the web to protect the email messages they send.

You need to make sure that users can use the new label to protect their email.

What should you do?

You are planning to implement Microsoft Purview Advanced Message Encryption.

You need to ensure that encrypted email sent to external recipients expires after seven days.

What should you create first?

You have a Microsoft SharePoint Online site named Site1 and a sensitivity label named Sensitivity1. Sensitivity1 adds both a watermark and a header to content.

You create a policy that automatically applies Sensitivity1 to emails in Microsoft Exchange Online and to Site1.

How will Sensitivity1 mark matching emails and documents in Site1?

You have a Microsoft 365 E5 subscription.

You need to create static retention policies for the following locations:

• Teams chats
• Exchange email
• SharePoint sites
• Microsoft 365 Groups
• Teams channel messages

What is the minimum number of retention policies needed?

You have a Microsoft 365 E5 subscription.

You need to review a usage report for Microsoft 365 Copilot.

Where should you review the report?

You have a Microsoft 365 subscription.

You identify these data loss prevention (DLP) requirements:

• Notify users when they attempt to send attachments containing an EU Social Security Number (SSN) or Equivalent ID.
• Prevent email messages that contain credit card numbers from being sent outside the organization.
• Block external sharing of Microsoft OneDrive content containing EU passport numbers.
• Send administrators email alerts whenever any rule is matched.

What is the minimum number of DLP policies and rules required to meet these requirements?

You have a Microsoft 365 E5 subscription containing two users named User1 and Admin1. Admin1 manages the subscription’s audit retention policies.

You need to ensure that User1’s audit logs are retained for 10 years.

What should you do first?

You are planning a data loss prevention (DLP) solution that applies to Windows Client computers.

You need to ensure that when users try to copy a file containing sensitive information to a USB storage device, these requirements are satisfied:

• If users are members of a group named Group1, they must be permitted to copy the file and an event must be written to the audit log.
• All other users must be prevented from copying the file.

What should you create?

You have a Microsoft 365 E5 subscription that includes the devices in the following table.

You plan to implement insider risk management and collect forensic evidence.

Which devices support forensic-evidence collection, and how should each supported device be prepared? Select the appropriate options in the answer area.

You have a Microsoft 365 E5 subscription containing the sensitive information types (SITs) in the following table.

You plan to create the policies in the following table and assign them to a Microsoft SharePoint Online site.

Identify which policies can use SIT1 and which can use SIT2.

You have a Microsoft 365 E5 tenant that contains a trainable classifier named Classifier1.

You need to improve the accuracy of Classifier1. The solution must follow the principle of least privilege.

Which feature should you use, and to which role group should you be added?

You have a Microsoft 365 E5 tenant that uses a domain named contoso.com.

A user named User1 sends link-based, branded emails encrypted by using Microsoft Purview Advanced Message Encryption to the recipients shown in the following table.

For which recipients can User1 revoke the emails?

You have a Microsoft 365 E5 subscription that includes a user named User1.

You deploy Microsoft Purview Data Security Posture Management for AI (DSPM for AI).

You need to ensure that User1 can check the subscription's auditing status. The solution must adhere to the principle of least privilege.

To which role group should you add User1?