SC-401 Practice Questions

Microsoft Purview Activity explorer provides pre-configured filters to drill down into specific data points, such as Sensitive info type. To ensure the exported data contains the specific sensitive info types detected for DLP rule matches, you must first apply the appropriate built-in filter to scope the view to those specific events. Regarding the export functionality, Microsoft Purview standardizes report exports from Activity explorer into the CSV (Comma-Separated Values) format, which allows for further analysis in tools like Microsoft Excel or Power BI.

Microsoft Purview Documentation: "Get started with activity explorer - Filtering and Exporting." [Link: https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer#filtering]

Microsoft Purview Documentation: "Exporting activity explorer records." (Specifies the export format as .csv). [Link: https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer#exporting-records]

Microsoft Purview Documentation: "Data Loss Prevention (DLP) activity explorer events." [Link: https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp#dlp-activity-explorer]

The proposed solution is incorrect. Endpoint Data Loss Prevention (DLP) functionality is natively integrated into the Windows 10 and Windows 11 operating systems. To enable Endpoint DLP policies to protect content on these computers, the devices must be onboarded into the Microsoft Purview compliance portal. The installation of the Microsoft Purview Information Protection (MIP) client is not the required step to enable the Endpoint DLP engine. The MIP client's primary function is for classification and labeling, and its functionality is increasingly being built directly into Microsoft 365 Apps, making the separate client unnecessary for this specific goal.

(Note: The provided question format with two "Yes" options is non-standard. Assuming a standard "A. Yes / B. No" format, the correct answer is No.)

A. Yes: This is incorrect because installing the Microsoft Purview Information Protection client does not enable the Endpoint DLP engine on Windows 11. The required action is device onboarding into Microsoft Purview.

1. Microsoft Learn. (2024). Get started with Endpoint data loss prevention. "For devices running Windows 10

Windows 11 and macOS (three latest released versions)

you don't need to install any additional software. Everything is already included." This source explicitly states that no additional client software is needed for Endpoint DLP on Windows 11.

URL: https://learn.microsoft.com/en-us/purview/endpoint-dlp-getting-started

2. Microsoft Learn. (2024). Onboard devices into Microsoft Purview solutions. This document details the required onboarding process for devices to be managed by Purview solutions

including Endpoint DLP

confirming that onboarding

not client installation

is the key step.

URL: https://learn.microsoft.com/en-us/purview/device-onboarding-overview

3. Microsoft Learn. (2024). Microsoft Purview Information Protection client - Version release history & support policy. This page describes the purpose of the MIP client

which is focused on applying sensitivity labels

confirming its role is distinct from enabling the core Endpoint DLP engine.

URL: https://learn.microsoft.com/en-us/purview/information-protection-client-version-release-history

Microsoft 365 Copilot respects the usage rights defined in Sensitivity Labels. To summarize, rewrite, or query a document, the user interacting with Copilot must possess the EXTRACT usage right (specifically the "Copy and extract content" permission) for that file. In the provided table, User1 is granted the EXTRACT right only for Label2, which is applied to File2. For Label1 (File1) and Label3 (File3), the EXTRACT right is explicitly "Not granted." Therefore, Copilot is blocked from processing those files, even though the user has VIEW permissions.

B. File3 only: File3 is assigned Label3, where the EXTRACT right is "Not granted." The EXPORT right (Save As) does not grant Copilot the necessary permission to process content.

C. File2 and File3 only: File3 is ineligible because it lacks the EXTRACT permission.

D. File1, File2, and File3: File1 and File3 are ineligible because they lack the EXTRACT permission.

Microsoft Learn - Microsoft Purview data security and compliance protections for Microsoft 365 Copilot:

Reference: "To use Copilot in Word, PowerPoint, Excel, and OneNote on files that have sensitivity labels ... the user must have the EXTRACT usage right."

Section: Sensitivity labels and encryption -> Usage rights.

Microsoft Learn - Restrict access to content using sensitivity labels to apply encryption:

Reference: "Copy and extract content (EXTRACT) ... This right is required for Microsoft 365 Copilot to access the file content."

Section: Configure encryption settings -> Usage rights definition.

Insider risk management notices are created and managed within the Microsoft Purview portal (specifically under the Insider Risk Management solution). These notices are used to communicate with users when a policy match occurs or when further investigation is required. To ensure professional presentation including the use of bolding, bullet points, and hyperlinks—the message body of these notice templates must be formatted using HTML. Other formats like Markdown, RTF, or XML are not supported for the message body of Microsoft Purview notice templates.

Official Vendor Documentation: Microsoft Purview Insider Risk Management - Notice Templates. This section specifies that templates are created in the Microsoft Purview compliance portal/Microsoft Purview portal.

Official Vendor Documentation: Create and manage insider risk notice templates. This guide details the step-by-step process of using the "Notice templates" tab and explicitly mentions that the "Message body" supports HTML for rich text formatting and layout control.

Official Vendor Documentation: Microsoft Purview compliance portal - Communication compliance. While related, it confirms that administrative actions for insider risks and user communications are centralized in the Purview interface.

To implement a custom trainable classifier in Microsoft Purview, you must follow a specific three-phase lifecycle: Seed, Test, and Publish.

1. Create: You first create the classifier by providing a seed set of at least 50 positive examples (documents that match the category).
2. Test: Once the initial training is complete, the classifier enters a "Need test items" state. You must upload and review test items, providing feedback by marking them as "Match" or "Not a Match" to refine accuracy.
3. Publish: Only after the classifier meets the required accuracy thresholds and is manually published can it be used as a condition in retention label or data loss prevention (DLP) policies.

Microsoft Purview Documentation: "Learn about trainable classifiers," Section: Process for creating a custom classifier. [Official Vendor Documentation]

Microsoft Purview Documentation: "Create a custom trainable classifier," Section: How to create a trainable classifier. [Official Vendor Documentation]

Microsoft Learn: "Get started with trainable classifiers," Section: Testing and publishing. [Official Vendor Documentation]

Activity explorer in the Microsoft Purview portal is the designated tool for monitoring activities related to information protection and data governance labels. It provides a detailed, historical view of actions, including the creation, modification, and deletion of retention labels. By filtering for "Retention label" activities within a specific date range, an administrator can precisely identify all changes made to these labels, directly fulfilling the requirement of the question.

A. Reports: The Reports section provides high-level, aggregated summaries and visualizations of label usage, but it does not offer a detailed audit log of administrative changes to the labels themselves.

C. User data search: This tool is designed to find and manage data associated with a specific user to fulfill Data Subject Requests (DSRs) under privacy regulations like GDPR, not for auditing administrative configurations.

D. Content search: This is an eDiscovery tool used to search for and export content (such as emails and documents) from Microsoft 365 locations, not to track changes made to compliance objects like retention labels.

---

1. Microsoft Learn. "Get started with activity explorer." Microsoft Purview documentation. This document states, "You can also use activity explorer to view activities related to retention labels that are applied to content across SharePoint, OneDrive, and Exchange." It lists specific auditable activities including Retention label created, Retention label updated, and Retention label deleted.

2. Microsoft Learn. "Learn about the audit log in Microsoft Purview." Microsoft Purview documentation. This document details the activities logged by Microsoft 365. While the audit log is the underlying source, Activity Explorer is the specialized interface presented as an option for viewing label-specific activities. The section on "Data governance activities" lists "Changed retention label" as a logged event.

3. Microsoft Learn. "Get started with Content search." Microsoft Purview documentation. This source clarifies the purpose of Content Search: "Use the Content search eDiscovery tool in the Microsoft Purview compliance portal to search for content such as email, documents, and instant messaging conversations in your organization." This confirms it is not for auditing administrative actions.

Microsoft Purview Insider Risk Management forensic evidence capture is currently supported exclusively on Windows 10 and Windows 11 (64-bit) platforms. Consequently, Device1 (Windows 11) and Device2 (Windows 10) are the only supported devices in the provided list; macOS and Android (Device3 and Device4) do not support the visual capture capabilities of this feature.

To enable forensic evidence, supported devices must meet two mandatory requirements: they must be onboarded to the Microsoft Purview portal (often via Microsoft Defender for Endpoint or a configuration package) to enable signal monitoring, and the Microsoft Purview client (specifically the forensic evidence agent) must be installed. The client is responsible for the actual capture and encryption of the user activity clips triggered by policy indicators.

Microsoft Learn. "Learn about Insider Risk Management forensic evidence." Microsoft Purview Documentation. Section: "Operating system" and "Prerequisites."

Directly states support for Windows 10/11 Enterprise and the requirement for both onboarding and client installation.

Microsoft Learn. "Get started with Insider Risk Management forensic evidence." Microsoft Purview Documentation. Section: "Step 2: Configure supported devices."

Confirms that devices must be onboarded and have the Microsoft Purview Client installed to collect and store clips.

Microsoft Learn. "Learn about and configure Insider Risk Management browser signal detection." Microsoft Purview Documentation. Section: "Common requirements."

Explicitly mentions that browser signal detection (related to forensic capture) isn't currently supported on non-Windows devices.

Microsoft Learn. "Onboard Windows devices into Microsoft 365 overview." Microsoft Purview Documentation.

Provides the framework for device onboarding shared across Endpoint DLP and Insider Risk Management.

The core requirement is to create a policy that specifically targets users based on their employment status (resignation or termination). This information resides in an organization's Human Resources (HR) system. Microsoft Purview Insider Risk Management uses an HR data connector to import these critical events, such as resignation dates and termination dates. This data acts as the primary "triggering event" for policies like "Data theft by departing users." Without this connector, the system cannot identify which users are departing and, therefore, cannot apply the policy as intended.

B. Configure Office indicators: Office indicators (like SharePoint activity) are signals of what a user is doing, not who the user is in terms of employment status. This is configured later, but the HR data is needed first to trigger the policy.

C. Configure a Physical badging connector: This connector imports data about physical access. While a useful signal, it is not the source for the required resignation or termination date information specified in the scenario.

D. Onboard devices to Microsoft Defender for Endpoint: This provides endpoint activity signals. Similar to Office indicators, this detects risky actions but does not provide the initial HR-based trigger (employment status) required by the policy.

1. Microsoft Learn. (2024). Get started with insider risk management. "To enable user-related signals for insider risk management policies

you'll need to configure a Microsoft 365 HR data connector. This connector is required to import resignation and termination date information from your organization's HR systems." This is listed as a prerequisite step before creating policies that depend on these triggers.

URL: https://learn.microsoft.com/en-us/purview/insider-risk-management-get-started#step-3-optional-but-recommended-configure-policy-indicators-and-connectors

2. Microsoft Learn. (2024). Create and manage insider risk management policies. When describing the "Data theft by departing users" policy template

the documentation states

"This policy template requires that you've configured the Microsoft 365 HR data connector to import user termination or resignation date information."

URL: https://learn.microsoft.com/en-us/purview/insider-risk-management-policies#policy-templates

3. Microsoft Learn. (2024). Set up a connector to import HR data. "You can set up a data connector in the Microsoft Purview compliance portal to import human resources (HR) data related to user's employment status... This HR data can then be used by the Data theft by departing users... insider risk management policy template to detect risky user activities."

URL: https://learn.microsoft.com/en-us/purview/import-hr-data

In Microsoft Purview, the DLP policy matches report tracks every instance where a rule is triggered, regardless of whether an alert was configured. This is essential for identifying rule activity that doesn't escalate to an alert. The Incident reports provide a granular view of policy violations, specifically including a section for the "Top files with most matches," which displays the most frequently flagged documents. Finally, the False positive and override report is designed to identify "miscategorized" data—cases where a user justified an action (override) or flagged a detection as incorrect (false positive), allowing administrators to refine policy accuracy.

Microsoft Purview Documentation: "View the DLP reports," Section: DLP policy matches.

Microsoft Purview Documentation: "View the DLP reports," Section: DLP incident reports (Granular detail on top files).

Microsoft Purview Documentation: "View the DLP reports," Section: DLP false positives and overrides.

Microsoft Learn: "Learn about the data loss prevention Alerts dashboard," Section: Investigating false positives.

Microsoft Purview Compliance: "Activity explorer and reports," Document Identifier: M365-Compliance-DLP-Reports-01.

To enable Microsoft Purview Data Security Posture Management for AI (DSPM for AI) to monitor user activities on third-party generative AI websites, the foundational endpoint monitoring infrastructure must be established. This involves two key steps. First, the Windows devices must be onboarded to Microsoft Purview, which registers them with the service and allows for the collection of activity signals. Second, the Microsoft Purview extension must be deployed to the browsers on these devices. This extension is crucial for capturing detailed user interactions within websites, such as pasting sensitive data into a generative AI prompt, which is a primary use case for DSPM for AI.

B. Create a data leaks policy: This is a configuration step to enforce rules, not a prerequisite to enable the monitoring infrastructure itself.

D. Create a communication compliance policy: This is a separate feature for monitoring internal communications like email and Teams, not for tracking activity on external websites.

E. Create an Endpoint data loss prevention (Endpoint DLP) policy: Creating a policy is a subsequent action. The underlying device onboarding and browser extension must be in place first to enable monitoring.

F. Enroll the devices in Microsoft Intune: While Intune is a common method for onboarding devices, it is not the only one. The fundamental prerequisite is device onboarding itself (Option C).

1. Microsoft. (2024). Get started with data security posture management for AI. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/data-security-posture-management-ai-get-started.

Reference Details: Under the "Prerequisites" section, the document explicitly states: "Onboard devices to Microsoft Purview" and "For visibility into user activities on websites, you must deploy the Microsoft Purview extension to your supported browsers". This directly supports answers C and A.

2. Microsoft. (2024). Get started with Endpoint data loss prevention. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/endpoint-dlp-getting-started.

Reference Details: The "Onboarding devices" section details the process required for Purview to monitor endpoint activities, confirming that device onboarding is a foundational step for features like DSPM for AI that rely on endpoint signals.

3. Microsoft. (2024). Learn about the Microsoft Purview extension. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/dlp-learn-about-browser-extension.

Reference Details: This document explains that the extension is required for Endpoint DLP to monitor and control activities in web browsers, such as "Upload to a cloud service, or access by unallowed browser" and "Copy to clipboard," which are essential for monitoring AI website usage.