Free SC-401 Exam Braindumps
Administering Information Security in Microsoft 365 (page: 19)

Updated On: 19-Oct-2026
View Related Case Study

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You recently discovered that the developers at your company emailed Azure Storage Account keys in plain text to third parties.
You need to ensure that when Azure Storage Account keys are emailed, the emails are encrypted.
Solution: You create a data loss prevention (DLP) policy that has Exchange email, SharePoint sites, OneDrive accounts, and Teams chat and channel messages selected.
Does this meet the goal?

  1. Yes
  2. No

Answer(s): A

Explanation:

Correct:
* You create a data loss prevention (DLP) policy that has only the Exchange email location selected.
To ensure Azure Storage Account keys are encrypted when sent via email, you need a Data Loss Prevention
(DLP) policy that detects Azure Storage Account keys using a sensitive information type and automatically encrypts emails containing these keys.
A DLP policy with Exchange email as the only location meets this requirement because it identifies sensitive data in email messages and it applies protection actions, such as encryption, blocking, or alerts.
* You create a data loss prevention (DLP) policy that has Exchange email, SharePoint sites, OneDrive accounts, and Teams chat and channel messages selected.OneDrive accounts, and Teams chat and channel messages selected.
Creating a Data Loss Prevention (DLP) policy that includes Exchange email as a location can help detect and prevent the sharing of sensitive information, like Azure Storage keys, in plain text. By setting up a DLP policy with conditions to identify Azure Storage keys and enforce encryption or blocking actions for Exchange email,
the policy will ensure that any emails containing such sensitive information are either encrypted or prevented from being sent.
Incorrect:
* You configure a mail flow rule that matches a sensitive info type.
* You configure a mail flow rule that matches the text patterns.
To ensure Azure Storage Account keys are encrypted when sent via email, you need a Data Loss Prevention
(DLP) policy that detects Azure Storage Account keys using a sensitive information type and automatically encrypts emails containing these keys.
Text patterns in mail flow rules are not as reliable as sensitive information types in DLP.
Mail flow rules lack advanced content detection and machine learning-based classification, making them less effective than DLP.
* You create a data loss prevention (DLP) policy that has all locations selected.


Reference:

https://docs.microsoft.com/en-us/exchange/policy-and-compliance/mail-flow-rules/conditions-and-exceptions



View Related Case Study

You have a Microsoft 365 E5 subscription.
You need to enable support for sensitivity labels in Microsoft SharePoint Online.
What should you use?

  1. the Microsoft Purview portal
  2. the Microsoft Entra admin center
  3. the SharePoint admin center
  4. the Microsoft 365 admin center

Answer(s): C

Explanation:

To enable support for sensitivity labels in Microsoft SharePoint Online, you must configure the setting in the
SharePoint admin center.
Sensitivity labels in SharePoint Online allow labeling and protection of files stored in SharePoint and OneDrive.
This feature must be enabled in the SharePoint admin center → Settings → Information protection to allow sensitivity labels to apply encryption and protection to stored documents.



View Related Case Study

HOTSPOT (Drag and Drop is not supported)
You have Microsoft 365 subscription that is enabled to support trainable classifiers.
You plan to create a custom trainable classifier based on an organizational form template.
You need to identify which role-based access control (RBAC) role is required to create the trainable classifier and where to store the seed content for the trainable classifier. The solution must use the principle of least privilege.
What should you identify? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:


Reference:

https://docs.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide#p repare-for-a-custom-trainable-classifier



View Related Case Study

HOTSPOT (Drag and Drop is not supported)
You have a Microsoft 365 subscription that contains a team in Microsoft Teams and a connected Microsoft
SharePoint Online site for a product research project.
Project documents are stored in SharePoint and are emailed to internal reviewers. Access to the project workspace must be restricted to approved internal users.
You need to create a sensitivity label for the project. The solution must meet the following requirements:
● All labeled documents and emails must be encrypted and display a visible marking.
● Teams and SharePoint workspaces must be private and block guest access.
What should you configure? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Explanation
Box 1: Encryption and content markings
To meet the requirement that all labeled documents and emails are encrypted and display a visible marking,
you should select encryption and content markings.
Select Encryption and content markings to encrypt file/email contents and apply visual indicators like headers,
footers, or watermarks.
Select Privacy and external user access settings separately when configuring the scope for Teams and
SharePoint container protection.
Box 2: Privacy and external user access
To configure the sensitivity label for the Teams and SharePoint workspaces, you should select privacy and external user access.
Privacy and external user access: This setting controls the privacy state (public or private) of the container
(Microsoft Teams and SharePoint/Microsoft 365 groups) and manages whether guest users are allowed access, which directly satisfies the second requirement.


Reference:

https://www.valprovia.com/en/blog/sensitivity-labels-in-microsoft-365
https://learn.microsoft.com/en-us/purview/sensitivity-labels-teams-groups-sites



View Related Case Study

You have a Microsoft 365 E5 subscription. The subscription contains a user named User1 and the sensitivity labels shown in the following table.

You publish the labels to User1.
The subscription contains the files shown in the following table.

Which files can Microsoft 365 Copilot summarize for User1?

  1. File2 only
  2. File3 only
  3. File2 and File3 only
  4. File1, File2, and File3

Answer(s): A

Explanation:

For Microsoft 365 Copilot to summarize data within a file, the user must have both the EXTRACT and VIEW
usage rights on the sensitivity label applied to that file, according to Microsoft Learn. This ensures that Copilot can access and process the file's content for summarization purposes. If a file is encrypted using Azure Rights
Management without a sensitivity label, the same permissions (EXTRACT and VIEW) are still required for
Copilot to function.


Reference:

https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-architecture-data-protection-auditi ng



Viewing page 19 of 60
Viewing questions 91 - 95 out of 291 questions


Post your Comments and Discuss Microsoft SC-401 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!