Microsoft SC-401 Practice Exam Questions & Answers

7 Free Questions Last reviewed November 14, 2026 Prepared & Reviewed by the ValidExamDumps Editorial Team

223 Practice Questions (Our Bank)
30 minutes Exam Duration
700 out of 1000 Passing Score
USD 165 Official Exam Fee
Exam Facts

Microsoft SC-401 Exam Details

Key details for this exam, checked against the published exam outline

Exam Code
SC-401
Full Name
Administering Information Security in Microsoft 365
Issuing Body
Microsoft
Question Format (Our Bank)
Multiple Choice, Hotspot, Drag & Drop, Case Studies
Delivery
Online proctored or at a Pearson VUE test centre
Eligibility
No formal prerequisites required. Familiarity with Microsoft 365 services, PowerShell, Microsoft Entra, and Microsoft Defender tools is recommended.
Validity
1 year from the date of passing. renewal requires passing a free online assessment on Microsoft Learn
Full Question Set
223 questions Get All Questions
Practice Questions

Free SC-401 Practice Questions

Each question shows the correct answer and an explanation of why it is right

VA
ValidExamDumps Editorial Team Every question and its answer is checked by our SC-401 exam preparation team, who also write the explanation shown with each one. How we research and review these pages

Question 1 Domain 1 Implement information protection

You have a Microsoft 365 E5 subscription that contains the adaptive scopes shown in the following table.

Question 1 exhibit

You create the retention policies shown in the following table.

Question 1 exhibit

Which retention policies support a preservation lock?

Correct Answer B
Explanation Trainable classifiers in Microsoft 365 need sample content to learn from patterns. SharePoint Online sites work well as training sources because they contain substantial amounts of real organizational data. Email folders and OneDrive locations are other valid sources, but SharePoint Online is commonly used. Exchange public folders are not supported for this purpose. The classifier uses the content you provide to understand what documents match your classification needs.

Question 2 Domain 1 Implement information protection

You have a Microsoft 365 subscription.

You create a new trainable classifier.

You need to train the classifier.

Which source can you use to train the classifier?

Correct Answer C

Question 3 Domain 2 Implement data loss prevention and retention

You create a retention label that has a retention period of seven years.

You need to ensure that documents containing a credit card number are retained for seven years. Other documents must not be retained.

What should you create?

Correct Answer C

Get the complete SC-401 question set $20$40

Get Full Access

Question 4 Domain 1 Implement information protection

You have a Microsoft 36S E5 subscription that has a Microsoft Purview exact data match (EDM) classifier named EDM1.

You plan to create the Microsoft Purview policies shown in the following table.

Question 4 exhibit

Which policies can use EDM1?

Correct Answer A
Explanation When you add sublabels to a parent label, they inherit the parent's policy settings but the parent policy controls the default behavior. To make Sublabel1 the default option for Group1, you must modify Label1's policy itself. You cannot override this at the sublabel level. Simply creating or configuring Sublabel1 alone will not change which label applies by default. The parent label policy determines what gets applied automatically to the group.

Question 5 Domain 1 Implement information protection

You need to meet the technical requirements for the creation of the sensitivity labels.

To which user or users must you assign the Sensitivity Label Administrator role?

Correct Answer D
Explanation

To meet the requirement that all administrative users must be able to create Microsoft 365 sensitivity labels, we need to assign the Sensitivity Label Administrator role to the correct users.

Sensitivity Label Administrator Role Responsibilities

This role allows users to:

Create and manage sensitivity labels in Microsoft Purview.

Publish and configure auto-labeling policies.

Modify label encryption and content marking settings.

Review of Admin Roles from the Table:

Question 5 explanation

Users that must be assigned the Sensitivity Label Administrator role:

Admin2 (Compliance Data Administrator)

Admin3 (Compliance Administrator)

Admin1 (Global Reader) (should be assigned this role to fulfill the requirement that all admins can create labels).

Question 6 Domain 2 Implement data loss prevention and retention

You have a sensitive information type based on a trainable classifier.

You are unsatisfied with the result of the trainable classifier.

You need to retrain the classifier.

What should you use in the Microsoft Purview portal?

Correct Answer A

Question 7 Domain 1 Implement information protection

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft 365 tenant and 500 computers that run Windows 11. The computers are onboarded to Microsoft Purview.

You discover that a third-party application named Tailspin_scanner.exe accessed protected sensitive information on multiple computers. Tailspin_scanner.exe is installed locally on the computers.

You need to block Tailspin_scanner.exe from accessing sensitive documents without preventing the application from accessing other documents.

Solution: From Microsoft Defender for Cloud Apps, you create an app discovery policy.

Does this meet the goal?

Correct Answer B
Explanation

Creating an app discovery policy in Microsoft Defender for Cloud Apps is used for detecting and monitoring cloud application usage, but it does not prevent a locally installed application (Tailspin_scanner.exe) from accessing sensitive files on Windows 11 devices.

To block Tailspin_scanner.exe from accessing sensitive documents while allowing it to access other files, the correct solution is to use Microsoft Purview Endpoint Data Loss Prevention (Endpoint DLP) and add Tailspin_scanner.exe to the Restricted Apps list.

Endpoint DLP allows you to block specific applications from accessing sensitive files while keeping general access available. Restricted Apps List in Endpoint DLP ensures that Tailspin_scanner.exe cannot open, copy, or process protected documents, but it can still function normally for non-sensitive content.

Study Guide

What the Microsoft SC-401 Exam Covers

Exam domains verified against the Official Microsoft SC-401 exam guide, last checked November 2026.

Domain 1 Implement information protection

30% - 35%

This domain covers data classification, sensitivity labels, and information protection across Windows, file shares, and Exchange. You need hands-on experience creating and managing sensitivity labels, configuring protection settings, and applying labels to containers like Teams, Groups, and SharePoint. Practice building custom sensitive info types and implementing the Purview Information Protection client to classify data across on-premises and cloud environments.

Sample questions from this domain above Q1Q2Q4Q5Q7

Domain 2 Implement data loss prevention and retention

30% - 35%

Focus on designing and configuring data loss prevention policies, implementing Endpoint DLP, and managing retention policies and labels. You should understand policy precedence, configure adaptive protection, and set up just-in-time protection. Hands-on work with DLP policy creation, testing policies to trigger alerts, and configuring retention labels for data lifecycle management will strengthen your readiness for this equally weighted domain.

Sample questions from this domain above Q3Q6

Domain 3 Manage risks, alerts, and activities

30% - 35%

This domain covers Insider Risk Management implementation, managing information security alerts, and protecting data used by AI services. You need to configure insider risk policies, manage alerts and cases, and respond to Purview alerts. Additionally, understand audit logging, content search, and the new controls for Data Security Posture Management for AI. All three domains carry equal weight, so ignoring this area will cost points.

FAQ

SC-401 Exam FAQ

Common questions about the exam itself

What is the SC-401 exam format and how much time do I have?
You have 100 minutes to answer approximately 40 to 60 questions. The exam uses multiple-choice, drag-and-drop, yes/no binary-choice items, hotspot questions, and case studies with scenario-based questions. One case study typically includes about 4 related questions and tests whether you can apply Purview configuration to a business problem rather than just recall definitions.
How hard is SC-401 compared to SC-400?
SC-401 is significantly different from the retired SC-400. Microsoft removed five entire topic areas, added DSPM for AI and Adaptive Protection, and restructured the exam into three equally weighted domains that test reasoning under time pressure. Candidates who arrive with old SC-400 study materials often score around 650 and fail because the exam now emphasizes practical configuration work over theoretical knowledge.
What hands-on preparation is most important for SC-401?
Complete all 13 lab exercises from the official instructor-led course in the MicrosoftLearning/SC-401T00 GitHub repository. Set up sensitivity labels end to end, build and test DLP policies, configure Insider Risk Management policies, generate alerts, and review them in every relevant portal. Everyone who passed quickly had one thing in common: they completed all the labs.
Do I need any certifications before attempting SC-401?
No. Microsoft lists no formal prerequisites for SC-401. However, you should have familiarity with Microsoft 365 services, PowerShell, Microsoft Entra, the Microsoft Defender portal, and Microsoft Defender for Cloud Apps. Hands-on experience with Purview Information Protection, sensitivity labels, DLP, retention, and insider risk management is strongly recommended.
What is the passing score for SC-401 and how is it calculated?
You need a scaled score of 700 out of 1000 to pass. This scaled score does not translate directly to a percentage of correct answers because Microsoft adjusts for question difficulty. Aim to master every domain rather than scraping through one, and aim for consistent scores of 80 to 90 percent on practice exams before scheduling.
How long should I study for SC-401?
Most candidates need 8 to 10 weeks at 10 to 15 hours per week if new to Microsoft Purview. If you have an active SC-400 background, you can compress to 4 to 6 weeks. If you are brand new to Microsoft security, extend to 12 to 16 weeks. Hands-on lab time in an E5 trial tenant is the single highest return on investment preparation activity.
How long does the SC-401 certification stay valid and how do I renew it?
Your certification is valid for one year from the date you pass. To renew, you must pass a free online assessment on Microsoft Learn before the 12-month window expires. There is no cost for renewing this way. If you miss the renewal window, your credential expires and you must retake the full exam at full price.
Which domain on SC-401 do most candidates struggle with?
The Data Loss Prevention and Retention domain challenges many candidates because it requires understanding policy precedence, adaptive protection rules, and retention label lifecycle management across overlapping scenarios. Many candidates underestimate Insider Risk Management and the new DSPM for AI controls. Since all three domains are equally weighted at 30 to 35 percent each, you cannot safely ignore any one.
What is the difference between SC-401 and SC-400, and which should I take?
SC-400 retired on 31 May 2025. SC-401 is its replacement but covers significantly different material. SC-401 focuses on information protection and data security with added coverage of AI data controls. If you are starting now, take SC-401. If you already hold SC-400, you can renew that certification using the free renewal assessment.
What job role does SC-401 prepare me for?
SC-401 validates skills for Information Security Administrators, Security Operations Analysts, Compliance Officers, and IT professionals involved in securing Microsoft 365 environments. The certification demonstrates expertise in implementing information protection, data loss prevention, managing insider risks, and responding to security alerts using Microsoft Purview and related services.

Other Microsoft Exams

Free practice questions for more Microsoft certification exams

AB-100 Practice Questions Agentic AI Business Solutions Architect AB-210 Practice Questions Accelerating Sales Pipelines with AI in Dynamics 365 AB-250 Practice Questions Transforming Contact Center Experiences with AI in Dynamics 365 AB-410 Practice Questions Building Intelligent Applications AB-620 Practice Questions Designing and Building Integrated AI Agent Solutions in Copilot Studio AB-650 Practice Questions Administering Microsoft 365 and AI Services AB-730 Practice Questions AI Business Professional AB-731 Practice Questions AI Transformation Leader

All Microsoft exams