SC-401 practice question 10 of 25

You have a Microsoft 365 E5 subscription that contains 500 Windows devices. You plan to deploy Microsoft Purview Data Security Posture Management for…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Implement data loss prevention

You have a Microsoft 365 E5 subscription that contains 500 Windows devices. You plan to deploy Microsoft Purview Data Security Posture Management for AI (DSPM for AI). You need to ensure that you can monitor user activities on third-party generative AI websites. Which two prerequisites should you complete for DSPM for AI? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Answer options

Correct Answer:

A, C

Explanation

To enable Microsoft Purview Data Security Posture Management for AI (DSPM for AI) to monitor user activities on third-party generative AI websites, the foundational endpoint monitoring infrastructure must be established. This involves two key steps. First, the Windows devices must be onboarded to Microsoft Purview, which registers them with the service and allows for the collection of activity signals. Second, the Microsoft Purview extension must be deployed to the browsers on these devices. This extension is crucial for capturing detailed user interactions within websites, such as pasting sensitive data into a generative AI prompt, which is a primary use case for DSPM for AI.

Why Incorrect

B. Create a data leaks policy: This is a configuration step to enforce rules, not a prerequisite to enable the monitoring infrastructure itself.

D. Create a communication compliance policy: This is a separate feature for monitoring internal communications like email and Teams, not for tracking activity on external websites.

E. Create an Endpoint data loss prevention (Endpoint DLP) policy: Creating a policy is a subsequent action. The underlying device onboarding and browser extension must be in place first to enable monitoring.

F. Enroll the devices in Microsoft Intune: While Intune is a common method for onboarding devices, it is not the only one. The fundamental prerequisite is device onboarding itself (Option C).

References

1. Microsoft. (2024). Get started with data security posture management for AI. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/data-security-posture-management-ai-get-started.

Reference Details: Under the "Prerequisites" section, the document explicitly states: "Onboard devices to Microsoft Purview" and "For visibility into user activities on websites, you must deploy the Microsoft Purview extension to your supported browsers". This directly supports answers C and A.

2. Microsoft. (2024). Get started with Endpoint data loss prevention. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/endpoint-dlp-getting-started.

Reference Details: The "Onboarding devices" section details the process required for Purview to monitor endpoint activities, confirming that device onboarding is a foundational step for features like DSPM for AI that rely on endpoint signals.

3. Microsoft. (2024). Learn about the Microsoft Purview extension. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/dlp-learn-about-browser-extension.

Reference Details: This document explains that the extension is required for Endpoint DLP to monitor and control activities in web browsers, such as "Upload to a cloud service, or access by unallowed browser" and "Copy to clipboard," which are essential for monitoring AI website usage.

Question 10 of 25

Question breakdown

Tests: Configure DSPM for AI prerequisites
Difficulty: Medium

Key idea: Seeing activity on third-party generative AI sites requires devices onboarded to Purview plus the Purview browser extension where native browser integration is absent.

How to reach the answer

The goal is visibility into third-party AI websites from Windows devices.
DSPM for AI collects these signals through endpoint capabilities, so devices must first be onboarded to Microsoft Purview.
Capturing browser activity such as prompts pasted into AI sites in browsers like Chrome needs the Microsoft Purview extension.
Policies such as DLP, data leaks, or communication compliance are created after the prerequisites, and Intune enrollment is only one possible onboarding method.

Each option

ACorrect. The Purview browser extension provides visibility into user interactions on AI websites.
BIncorrect. A data leaks policy is a configuration you create afterward, not a prerequisite for monitoring.
CCorrect. Device onboarding to Purview is the foundation for collecting endpoint activity signals.
DIncorrect. Communication compliance reviews communications in tools like Teams and email, not browser activity on external AI sites.
EIncorrect. An Endpoint DLP policy is a later enforcement or monitoring step that depends on onboarding being complete.
FIncorrect. Intune enrollment is just one way to onboard devices and is not itself required.

Common trap: Choosing Intune enrollment because it is often used to deploy onboarding, when the actual prerequisite is Purview onboarding by any supported method.

In practice: Organizations worried about staff pasting sensitive data into consumer AI tools onboard devices to Purview and push the Purview extension to Chrome with policy. They then review AI interactions in DSPM for AI.

Remember: DSPM for AI web visibility needs two prerequisites: Purview device onboarding and the Purview browser extension.

Official documentation: Microsoft Purview data security and compliance protections for generative AI apps · Learn about the Microsoft Purview extension

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free SC-401 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test