Hard — SC-401 Practice Quiz

Question 1

Contoso has deployed Endpoint DLP to onboarded Windows devices. Users routinely upload documents to sanctioned corporate cloud services but occasionally paste sensitive files into personal cloud storage sites through the browser. Security wants Endpoint DLP to ALLOW uploads to approved corporate cloud domains while BLOCKING uploads of sensitive content to all other web destinations. Which configuration should you implement?

Accepted Answer

Configure a list of 'Service domains' (sensitive service domains / allowed domains) in Endpoint DLP settings, then create a DLP rule that blocks the 'Upload to a restricted cloud service domain' activity for content matching the sensitive info types.

Answer

Add the corporate cloud domains to the 'Unallowed browsers' list and set the 'Upload to cloud services' action to Block.

Answer

Enable Just-in-time protection so that any file uploaded to an unclassified browser destination is automatically blocked until evaluated.

Answer

Add the corporate cloud domains as exclusions under 'Restricted apps and app groups' and block all browser processes globally.

Question 2

Your organization has deployed Microsoft 365 Copilot and also allows employees to use consumer generative AI apps such as ChatGPT and Google Gemini from company devices. Security leadership wants a single dashboard in Purview that surfaces sensitive data being shared with BOTH Copilot and these third-party AI sites, including which sensitivity labels and sensitive info types are involved. Before this cross-app visibility works in DSPM for AI, which prerequisite must you complete for the third-party AI site activity to appear?

Accepted Answer

Onboard the devices to Microsoft Purview and enable the Microsoft Purview browser extension (or Edge integration) so that Endpoint DLP can capture activity to third-party generative AI sites

Answer

Create an Insider Risk Management policy using the data theft template and assign the Adaptive Protection connector

Answer

Configure a Defender for Cloud Apps session policy to proxy all traffic to ChatGPT and Gemini through a reverse proxy

Answer

Enable Audit (Premium) retention policies for the Copilot interaction audit records so the events are retained for one year

Question 3

Contoso has deployed Microsoft 365 Copilot and enabled DSPM for AI. The security team reports that employees are pasting content labeled 'Highly Confidential' into third-party generative AI sites such as public ChatGPT, and they also want to reduce the risk of users prompting Copilot with sensitive data. Which combination of Purview DSPM for AI capabilities should you configure to address BOTH concerns with the least administrative effort?

Accepted Answer

Use the DSPM for AI recommendation to create a DLP policy that restricts sensitive content in AI prompts, and apply the 'Fortify your data security for AI' policy that detects sensitive interactions in Copilot.

Answer

Deploy an Endpoint DLP policy alone to block all AI websites for every user, and disable Copilot for the tenant.

Answer

Configure only an Insider Risk Management policy using the 'Data leaks' template to capture browsing to AI sites.

Answer

Enable Audit (Premium) logging for Copilot interactions and rely on Activity explorer to manually review and remediate risky prompts each week.

Question 4

Your organization has onboarded Windows 11 devices to Purview Endpoint DLP. The compliance team wants to prevent users from copying files that contain credit card numbers to unmanaged network file shares, while still allowing copies to a specific approved corporate share (\corp-fs01\secure). Copies to the approved share should be permitted without any user prompt. What is the correct way to configure the Endpoint DLP rule to meet these requirements?

Accepted Answer

Configure the 'Copy to a network share' activity to Block (without user override), and add \corp-fs01\secure as an excluded network share path group in Endpoint DLP settings.

Answer

Add \corp-fs01\secure to the list of unallowed network share paths and set the 'Copy to a network share' action to Block.

Answer

Set the 'Copy to a network share' activity to Audit only and rely on Adaptive Protection to block risky users automatically.

Answer

Create a sensitivity label that encrypts the files and publish it so only \corp-fs01\secure can decrypt them.

Question 5

Your organization has onboarded 200 Windows 11 devices to Microsoft Purview Endpoint DLP. Security notices that users are copying documents containing credit card numbers to removable USB drives. You must configure an Endpoint DLP rule that blocks copying such files to USB devices but still allows copying to corporate-approved USB drives without any prompt. What should you configure?

Accepted Answer

Set the 'Copy to a USB removable media device' activity to Block, define an allowed 'Removable storage device groups' entry in Endpoint DLP settings, and apply that group as an exclusion in the rule

Answer

Set the 'Copy to a USB removable media device' activity to Block, and add the approved drives to the 'Unallowed USB devices' list

Answer

Set the 'Copy to a USB removable media device' activity to Block, and add the approved drives as 'Printer groups' exclusions in Endpoint DLP settings

Answer

Enable just-in-time protection for all devices and rely on the default policy to allow corporate USB drives

Question 6

Contoso created an exact data match (EDM) sensitive information type based on a schema that includes CustomerID, LastName, and CreditCardNumber. Compliance analysts report that DLP is generating too many false positives because a match is triggered whenever a CreditCardNumber alone appears in a document, even without any related customer data. You need to reduce false positives by requiring that a detected CreditCardNumber must appear together with at least one other field from the same data row before it counts as an EDM match. Which EDM configuration change should you make?

Accepted Answer

Configure supporting elements (additional evidence) for the primary element in the EDM rule package so that CreditCardNumber requires a nearby matching supporting field.

Answer

Increase the confidence level of the underlying built-in Credit Card Number sensitive info type to High.

Answer

Re-upload the sensitive data table using a larger sample so the hashing algorithm becomes more selective.

Answer

Mark all three fields as primary elements so that any single field match satisfies the EDM condition.

Question 7

Your organization uses Purview Insider Risk Management to detect data leaks. A concern has been raised that a user may be slowly exfiltrating data by copying small amounts of sensitive files to USB devices over several weeks — each individual action is too small to trigger a threshold alert, but the aggregated volume is significant. Which policy capability should you rely on to surface this pattern?

Accepted Answer

Cumulative exfiltration activities detection

Answer

Anomaly detection based on the user's daily baseline of activity

Answer

Sequence detection linking collection and exfiltration events

Answer

Priority user group scoping to raise alert sensitivity

Question 8

Contoso uses Purview Message Encryption. A compliance officer sends an encrypted email from Outlook on the web to an external recipient at a partner organization. The email contains a Word document attached from the sender's OneDrive as a cloud attachment (sharing link) rather than a copy. The compliance officer wants to ensure the attached document itself remains protected when the external recipient opens it. What determines whether the linked document is protected?

Accepted Answer

The document's protection depends on the sensitivity label and sharing permissions configured on the file in OneDrive, not on the message encryption applied to the email.

Answer

Purview Message Encryption automatically applies encryption to any cloud attachment link included in the encrypted message.

Answer

Cloud attachments cannot be included in encrypted emails, so the message will fail to send until the file is attached as a copy.

Answer

The external recipient must install the Purview Information Protection client before the cloud attachment link will resolve.

Question 9

Contoso must protect a small set of highly sensitive research documents so that the encryption keys are held entirely by Contoso and are never accessible to Microsoft, while still allowing these documents to be labeled and consumed in Office desktop apps. Which encryption configuration should you implement for the sensitivity label protecting these documents?

Accepted Answer

Configure the label to use Double Key Encryption (DKE) with a customer-hosted key service.

Answer

Configure the label to use Microsoft-managed keys (default cloud-based encryption).

Answer

Configure the label to use Bring Your Own Key (BYOK) with Azure Key Vault.

Answer

Configure the label with content marking and a dynamic watermark only.

Question 10

Your organization uses Purview sensitivity labels with encryption. Legal team members frequently travel and need to open highly confidential documents while disconnected from the corporate network for up to two weeks. Security requires that if an employee leaves, access to protected content can be revoked quickly. When configuring the encryption settings on the sensitivity label, which setting directly controls the trade-off between offline access duration and how quickly revoked access takes effect?

Accepted Answer

The 'Allow offline access' setting, configuring the number of days content is available without reconnecting

Answer

The 'Assign permissions now or let users decide' option

Answer

The 'Content expiration' setting that specifies when encrypted content stops being accessible

Answer

The 'Encrypt only' option in Purview Message Encryption