Free SC-401 Exam Braindumps
Administering Information Security in Microsoft 365 (page: 9)

Updated On: 19-Oct-2026
View Related Case Study

You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. Site1
contains a file named File1.
You have a retention policy named Retention1 that has the following settings:
▪ Retain items for a specific period
▪ - Retention period: 5 years
▪ - At the end of the retention period: Delete items automatically
Retention1 is applied to Site1.
You need to ensure that File1 is deleted automatically after seven years. The solution must NOT affect the retention of other files on Site1.
What should you do first?

  1. Publish and apply a new retention label.
  2. Move File1 to a new folder and configure the access control list (ACL) entries for File1.
  3. Create a new retention policy.
  4. Move File1 to a new folder and list the excluded locations for Retention1.

Answer(s): A

Explanation:

To ensure the specific file is deleted automatically after seven years without altering the retention behavior of other files on the site, your best first step is to create a new 7-year retention label and publish it to the
SharePoint site.
Granular Control: A retention label applies directly to individual items (files or folders), whereas a retention policy applies broadly to the entire site.
Label Precedence: In Microsoft 365 retention principles, an explicit retention label takes precedence over a broader site-level retention policy if the label is more restrictive or has a different explicit duration applied directly to the item.
Zero Impact on Other Files: Publishing the label makes it available for use, but it will not affect any other files on the site until it is specifically applied to them.


Reference:

https://learn.microsoft.com/en-us/answers/questions/5127195/list-cannot-be-deleted-while-on-hold-or-retention



View Related Case Study

HOTSPOT (Drag and Drop is not supported)
You have a Microsoft 365 subscription.
In Microsoft Exchange Online, you configure the mail flow rule shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: must sign in to the Message Encryption portal to read messages.
Recipients who use Gmail
Recipients using Gmail can read emails protected by Microsoft Exchange Online mail flow rules set to Protect with OMEv2 (Office Message Encryption version 2). They will typically receive a link to view the message in the
Microsoft Purview Message Encryption portal.
OMEv2 and Gmail:
When a mail flow rule in Exchange Online is configured to protect emails with OMEv2 and the recipient is using
Gmail, the email is not directly readable within Gmail.
The Encryption Portal:
Instead, the recipient will receive an email containing a link to the Microsoft Purview Message Encryption portal.
Accessing the Content:
To read the email and any attachments, the recipient will need to click the link and either sign in with a
Microsoft account or authenticate using a one-time passcode.
Box 2: will have messages decrypted automatically
Recipients from an external Microsoft 365 subscription.
Recipients from an external Microsoft 365 subscription can read emails protected by a Microsoft Exchange
Online mail flow rule set to "Protect with OMEv2" (Microsoft Purview Message Encryption). External recipients will receive a wrapper email with instructions on how to access the encrypted message, either by signing in with their Microsoft account, Google account, Yahoo account, or by using a one-time passcode.
OMEv2 (Microsoft Purview Message Encryption):
This feature encrypts emails as they are sent, using a mail flow rule, ensuring that only authorized recipients can read them.
External Recipient Access:
When an external recipient (from a different Microsoft 365 tenant or even another email provider like Gmail or
Yahoo) receives an email encrypted with OMEv2, they will receive a wrapper email that directs them to a portal.
Accessing the Encrypted Message:
The portal will then allow the recipient to authenticate using their existing Microsoft account, a Google or Yahoo account, or by requesting a one-time passcode.
First-class Reading Experience:
If the external recipient uses Outlook on the web, desktop, or mobile, they will generally have a seamless reading experience once authenticated.
No Special Software Required:
The recipient does not need to install any additional software or apps to read the message.
Wrapper Email:
The wrapper email is a standard email that contains information about the encrypted message and instructions on how to access it.
How to block outgoing emails with mail flow rules in Office 365
In essence, OMEv2 provides a secure way to share sensitive information with external recipients without requiring them to be part of the same Microsoft 365 organization.


Reference:

https://learn.microsoft.com/en-us/purview/email-encryption https://learn.microsoft.com/en-us/purview/ome



View Related Case Study

You plan to implement Microsoft Purview Advanced Message Encryption.
You need to ensure that encrypted email sent to external recipients expires after seven days.
What should you create first?

  1. a mail flow rule
  2. an X.509 version 3 certificate
  3. a custom branding template
  4. a remote domain in Microsoft Exchange
  5. a connector in Microsoft Exchange

Answer(s): C

Explanation:

You can use message expiration on emails that your users send to external recipients who use the OME Portal to access encrypted emails. You force recipients to use the OME portal to view and reply to encrypted emails sent by your organization by using a *custom branded template* that specifies an expiration date in
PowerShell.
Note: Create a custom branding template to force mail expiration by using PowerShell
1. Using a work or school account that has sufficient permissions in your organization, such as Compliance
Administrator, start a Windows PowerShell session and connect to Exchange Online. For instructions, see
Connect to Exchange Online PowerShell.
2. Run the New-OMEConfiguration cmdlet.
New-OMEConfiguration -Identity "Expire in 7 days" -ExternalMailExpiryInDays 7
Where:
Identity is the name of the custom template.
ExternalMailExpiryInDays identifies the number of days that recipients can keep mail before it expires. You can use any value between 1–730 days.


Reference:

https://learn.microsoft.com/en-us/purview/ome-advanced-expiration



View Related Case Study

SIMULATION
Username and password
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and select the username below.
To enter your password, place your cursor in the Enter password box and select the password below.
Microsoft 365 Username:
admin@WWLx121586.onmicrosoft.com
Microsoft 365 Password: XXXXXXXXX
If the Microsoft Edge browser or Microsoft 365 portal does not load successfully, select the Microsoft Edge browser icon from the task bar, type the URL “https://admin.microsoft.com”, and press Enter.
The following information is for technical support purposes only:
Lab Instance: XXXXXXXXX
Task 5
You need to simulate applying the Confidential - Finance label to all the content in the Exchange emails, the
SharePoint sites, and the OneDrive accounts that contain the Credit Card Number sensitive info type.

  1. See Explanation section for answer.

Answer(s): A

Explanation:

See explanation below.


Simulation mode is supported for auto-labeling policies and woven into the workflow. You can't automatically label documents and emails until your policy has run at least one simulation.
Workflow for an auto-labeling policy:
1. Create and configure an auto-labeling policy.
2. Run the policy in simulation mode, which can take 12 hours to complete. The completed simulation triggers an email notification that's sent to the user configured to receive activity alerts.
3. Review the results, and if necessary, refine your policy.
4. Repeat step 3 as needed.
5. Deploy in production.
--
Creating an auto-labeling policy
Step 1: Sign in to the Microsoft Purview portal > Solutions > Information Protection > Policies > Auto-labeling policies.
Step 2: Select + Create auto-labeling policy. This starts the New policy configuration:

Step 3: For the Choose a label to auto-apply page: Select + Choose a label, select a label from the Choose a sensitivity label pane, and then select Next.
Step 4: For the page Choose info you want this label applied to: Select one of the templates, such as Financial or Privacy [Select Confidential - Finance label]. You can refine your search by using the search or dropdown box for countries or regions. Or, select Custom policy if the templates don't meet your requirements. Select
Next.
Step 5: For the page Name your auto-labeling policy: Provide a unique name, and optionally a description to help identify the automatically applied label, locations, and conditions that identify the content to label.
Step 6: For the page Assign admin units: [Keep default]
If you don't want to restrict the policy by using administrative units, or your organization hasn't configured administrative units, keep the default of Full directory.
Step 7: For the page Choose locations where you want to apply the label: Select and specify locations for
Exchange, SharePoint, and OneDrive.

Step 8: For the Set up common or advanced rules page: Keep the default of Common rules to define rules that identify content to label across all your selected locations. If you need different rules per location, including some rules that are only available for Exchange, or SharePoint sites and OneDrive accounts, select Advanced rules. Then select Next. [select Advanced rules. Then select Next]
8a. To select a sensitive information type or trainable classifier as a condition, under Content contains, select
Add, and then choose Sensitive info types or Trainable classifiers.
8b. Select the the Credit Card Number sensitive info type.
Step 9: Depending on your previous choices, you'll now have an opportunity to create new rules by using conditions and exceptions. [Skip]
Step 10: If your policy includes the Exchange location: Specify optional configurations [Skip]
Step 11: For the Decide if you want to test out the policy now or later page: Select Run policy in simulation mode if you're ready to run the auto-labeling policy now, in simulation mode.

Step 12: For the Summary page: Review the configuration of your auto-labeling policy and make any changes that needed, and complete the configuration.


Reference:

https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically



View Related Case Study

HOTSPOT (Drag and Drop is not supported)
You have a Microsoft 365 E5 subscription.
You have a Microsoft Purview Advanced Message Encryption branding template named OME1.
You need to create a Microsoft Exchange Online mail flow rule to apply OME1 to email.
How should you configure the rule? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: The Sender
Create an Exchange mail flow rule that applies your custom branding to encrypted emails sent from your online organization to external recipients
In Apply this rule if, select the condition The sender is located inside the organization and other conditions you want from the list of available conditions. For example, you might want to apply a particular branding template to:
All encrypted emails sent from members of the finance department
Encrypted emails sent with a certain keyword such as "External" or "Partner"
Encrypted emails sent to a particular domain
Box 2: Is External/internal
Box 3: Modify the message security.
From Do the following, select Modify the message security > Apply custom branding to OME messages. Next,
from the drop-down, select a branding template.
Select add action if you want to specify another action, or select Save, and then select OK.


Reference:

https://learn.microsoft.com/en-us/microsoft-365/compliance/add-your-organization-brand-to-encrypted-messag es



Viewing page 9 of 60
Viewing questions 41 - 45 out of 291 questions


Post your Comments and Discuss Microsoft SC-401 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!