Microsoft Role-based SC-400 Questions & Answers

• Question 31:

  You have a Microsoft 365 tenant that uses 100 data loss prevention (DLP) policies.

  A Microsoft Exchange administrator frequently investigates emails that were blocked due to DLP policy violations.

  You need recommend which DLP report the Exchange administrator can use to identify how many messages were blocked based on each DLP policy.

  Which report should you recommend?

  A. Third-party DLP policy matches

  B. DLP policy matches

  C. DLP incidents

  D. False positive and override

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/dlp-learn-about-dlp?view=o365-worldwide

• Question 32:

  You have a Microsoft 365 tenant. You create the following:

  1.

  A sensitivity label

  2.

  An auto-labeling policy

  You need to ensure that the sensitivity label is applied to all the data discovered by the auto-labeling policy.

  What should you do first?

  A. Enable insider risk management.

  B. Create a trainable classifier.

  C. Run the Enable-TransportRule cmdlet.

  D. Run the policy in simulation mode.

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide

• Question 33:

  You have a sensitive information type based on a trainable classifier.

  You are unsatisfied with the result of the result of trainable classifier.

  You need to retrain the classifier.

  What should you use in the Microsoft 365 compliance center?

  A. Labels from Information protection

  B. Labels from Information governance

  C. Content explorer from Data classification

  D. Content search

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/classifier-how-to-retrain-content-explorer?view=o365-worldwide

• Question 34:

  Your company has a Microsoft 365 tenant that uses a domain named contoso.com.

  The company uses Microsoft Office 365 Message Encryption (OME) to encrypt email sent to users in fabrikam.com.

  A user named User1 erroneously sends an email to [email protected].

  You need to prevent [email protected] from accessing the email.

  What should you do?

  A. Run the Get-MessageTrace cmdlet.

  B. Run the Set-OMEMessageRevocation cmdlet.

  C. Instruct User1 to delete the email from her Sent Items folder from Microsoft Outlook.

  D. Run the New-ComplianceSearchAction cmdlet.

  E. Instruct User1 to select Remove external access from Microsoft Outlook on the web.

  Correct Answer: B

• Question 35:

  You have a Microsoft 365 tenant.

  You discover that email does NOT use Microsoft Office 365 Message Encryption (OME).

  You need to ensure that OME can be applied to email.

  What should you do first?

  A. Enable Microsoft Defender for Office 365.

  B. Activate Azure Information Protection.

  C. Activate Azure Rights Management (Azure RMS).

  D. Create an Azure key vault.

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/set-up-new-message-encryption-capabilities?view=o365-worldwide

• Question 36:

  You have a Microsoft 365 tenant that uses Microsoft Office 365 Message Encryption (OME).

  You need to ensure that any emails containing attachments and sent to [email protected] are encrypted automatically by using OME.

  What should you do?

  A. From the Exchange admin center, create a new sharing policy.

  B. From the Microsoft 365 security center, create a Safe Attachments policy.

  C. From the Exchange admin center, create a mail flow rule.

  D. From the Microsoft 365 compliance center, configure an auto-apply retention label policy.

  Correct Answer: C

  You can create mail flow rules to help protect email messages you send and receive. You can set up rules to encrypt any outgoing email messages and remove encryption from encrypted messages coming from inside your organization or from replies to encrypted messages sent from your organization.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/define-mail-flow-rules-to-encrypt-email?view=o365-worldwide

• Question 37:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are configuring a file policy in Microsoft Cloud App Security.

  You need to configure the policy to apply to all files. Alerts must be sent to every file owner who is affected by the policy. The policy must scan for credit card numbers, and alerts must be sent to the Microsoft Teams site of the affected

  department.

  Solution: You use the Built-in DLP inspection method and send alerts as email.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Alerts must be sent to the Microsoft Teams site of the affected department. A Microsoft Power Automate playbook should be used.

  Reference: https://docs.microsoft.com/en-us/cloud-app-security/content-inspection-built-in https://docs.microsoft.com/en-us/cloud-app-security/flow-integration

• Question 38:

  You plan to import a file plan to the Microsoft 365 compliance center.

  Which object type can you create by importing a records management file plan?

  A. retention label policies

  B. sensitive info types

  C. sensitivity labels

  D. retention labels

  Correct Answer: D

  File plan in Records management allows you to bulk-create retention labels by importing the relevant information from a spreadsheet.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/file-plan-manager?view=o365-worldwide

• Question 39:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are configuring a file policy in Microsoft Cloud App Security.

  You need to configure the policy to apply to all files. Alerts must be sent to every file owner who is affected by the policy. The policy must scan for credit card numbers, and alerts must be sent to the Microsoft Teams site of the affected

  department.

  Solution: You use the Built-in DLP inspection method and send alerts to Microsoft Power Automate.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/cloud-app-security/content-inspection-built-in https://docs.microsoft.com/en-us/cloud-app-security/flow-integration

• Question 40:

  Your company manufactures parts that are each assigned a unique 12-character alphanumeric serial number. Emails between the company and its customers reference the serial number.

  You need to ensure that only Microsoft Exchange Online emails containing the serial numbers are retained for five years.

  Which three objects should you create? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. a sensitivity label

  B. a retention policy

  C. an auto-labeling policy

  D. a trainable classifier

  E. a sensitive info type

  F. a retention label

  G. a data loss prevention (DLP) policy

  Correct Answer: CEF

  C: One of the most powerful features of retention labels is the ability to apply them automatically to content that matches specified conditions.

  F: You can apply retention labels to content automatically when that content contains: Specific types of sensitive information Specific keywords or searchable properties that match a query you create A match for trainable classifiers

  E: Sensitive information types are pattern-based classifiers. They detect sensitive information like social security, credit card, or bank account numbers to identify sensitive items. Custom sensitive information types use regular expressions, keywords, and keyword dictionaries.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitive-information-type-learn-about?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide