Free SC-401 Exam Dumps Preview

Step 1 Summarization in Copilot
For Microsoft 365 Copilot to summarize a file: The user needs at least View permission.
Summarization does not require editing, copying, or ownership rights.
Looking at the exhibit: User1 (Co-Owner) # has full access including view.
User2 (Co-Author) # has edit and view.
User3 (Reviewer) # has read-only rights.
User4 (Viewer) # has read rights.
All four users can view the document. Therefore, Copilot can summarize File1 for User1, User2, User3, and User4.

Step 2 Referencing a file by link in Copilot
For Copilot to reference a file by link (i.e., cite or share within generated content): The user must have rights that include resharing or exporting. Only the Co-Owner has full rights to manage access and allow referencing by link.
From the exhibit:
User1 (Co-Owner) # Can reference by link.
User2 (Co-Author), User3 (Reviewer), User4 (Viewer) # Do not have reshare or link rights.
So, only User1 can reference File1 by link.
References:
Sensitivity labels and Microsoft 365 Copilot

Marking an application as Unsanctioned in Defender for Cloud Apps is intended to control cloud-app access and does not create content-aware restrictions for a locally installed executable. It cannot allow Tailspin_scanner.exe to open ordinary documents while blocking only its access to sensitive documents.

User1: Since the Microsoft Purview browser extension is installed on Device1, AI-related activity performed by User1 (generating an image using a generative AI website) can be reviewed in Activity explorer in DSPM for AI.
User2: Since Device2 does not have the Microsoft Purview browser extension installed, AI-related activity cannot be tracked in DSPM for AI. Instead, Audit log search should be used to review activity such as using Microsoft 365 Copilot.
User3: Since Device3 has the Microsoft Purview browser extension installed, AI-related activity (browsing sample content on a generative AI website) can be reviewed using Activity explorer in DSPM for AI.

AutoApply1 is an auto-labeling policy that applies RLabel1 to Group1. Auto-labeling policies can apply retention labels across group mailboxes, SharePoint Online sites, and Teams channel messages if they are configured for group resources.

Retention1 is a retention policy applied to Group2. Retention policies for Microsoft 365 groups apply to all group resources, including group mailboxes, SharePoint Online teams sites, and Teams channel messages. Since both AutoApply1 and Retention1 affect entire groups, they apply to all associated resources: group mailbox, SharePoint Online teams site, and Teams channel messages.

Insider risk management analytics examines recent tenant activity and generates recommendations for policy indicator thresholds. Enabling analytics is therefore the prerequisite for receiving real-time guidance based on the specified past 10 days of user activity. Connectors, data sharing, and DLP policies do not perform this threshold analysis.

A DLP policy scoped to the Teams chat and channel messages location protects message content involving the included users across Teams conversation types. This coverage includes 1:1 and group chats, general channels, and private channels, rather than being limited to only one channel category.

Box 1: No No - The results of Search1 include File2.docx.

Author Mismatch: Search1 requires the author to be User1 (Author: User1). Actual Author: The file File2.docx was authored by User2.

Box 2: No No - The results of Search2 include File1.docx, File2.docx, FileA.pptx, and FileB.docx.

File extension mismatch: Search2 requires a.docx extension (FileExtension:docx). File FileA is a presentation: FileA.pptx is a PowerPoint file, so it is automatically excluded.

Box 3: Yes Yes-The results of Search3 include FileB.docx.

Location Match: Search3 targets site Site2, which is where FileB.docx is stored. Condition Match: Search3 looks for Author: User1. FileB.docx was authored by user User1.

References:
https://learn.microsoft.com/en-us/sharepoint/dev/general-development/building-search-queries-in-
sharepoint

Device onboarding is already complete, so endpoint readiness is not the missing condition. The policy currently evaluates only Exchange and SharePoint, which leaves the USB rule outside its selected locations. Adding Devices to the DLP policy locations enables evaluation of endpoint file-copy activity.

To create a custom trainable classifier in Microsoft Purview (formerly Microsoft Compliance Center), you must first opt into the trainable classifier feature.

Before using custom trainable classifiers, Microsoft requires manual opt-in through the Microsoft Purview compliance portal. Without this step, you cannot create a new classifier. The Compliance Administrator role has the necessary permissions to configure data classification, DLP policies, and trainable classifiers.
Global Administrator has higher privileges but is not required for this task, violating the principle of least privilege. Security Administrator is focused on security-related settings but does not manage compliance features like classifiers.

One Endpoint DLP policy can contain both required behaviors, but they need separate rules. One rule targets Group1 and audits the USB copy while allowing it; the second applies to all other users and blocks the copy. Distinct conditions and actions cannot be represented by a single rule.

A trainable classifier learns from example documents stored in a supported Microsoft 365 content source. A Microsoft SharePoint Online site can hold the positive and negative examples used during training. The listed on-premises SharePoint, Azure Files, and NFS sources do not provide the required training source for this classifier.

First create the retention label in the Microsoft Purview portal to define its retention behavior. Then publish the label through a label policy so users can see and apply it. Creation defines the control, while publication makes it available for individual documents in SharePoint libraries.

Trainable classifiers can identify content for retention and DLP decisions. Label2 is a retention label, Policy1 is a retention label policy, and DLP1 is a data loss prevention policy, so each can use Trainable1. Label1 is a sensitivity label and is outside this supported set.

Step 1 Requirement analysis
You need to prevent users from: Pasting credit card numbers into ChatGPT/Google Gemini.
Uploading classified documents into ChatGPT/Google Gemini. Both scenarios involve AI websites.
Microsoft Purview provides Data Security Posture Management for AI and Endpoint DLP integrations that work through Data Loss Prevention (DLP) and Insider Risk Management policies.

Step 2 ?Credit card numbers
Credit card numbers are structured sensitive information types (SITs).
DLP policies are the correct Microsoft Purview solution for detecting and blocking sensitive info (e.g., credit card, SSN, health ID) from being copied, pasted, or uploaded into restricted destinations like AI apps.
Therefore, Data Loss Prevention is the right choice.
# Reference: Learn about Endpoint DLP and AI sites

Step 3 ?Documents
Documents containing classified or labeled data (via sensitivity labels) fall under insider risk activity detection when exfiltrated.
Insider Risk Management policies can monitor and block uploads of classified/labeled files to AI services such as ChatGPT or Gemini.
Therefore, Insider Risk Management is the right choice for preventing document uploads.
# Reference: Insider Risk Management ?risky AI activity detection

A DLP policy needs a content classification that can recognize the specified terms. A custom sensitive information type provides that reusable classification, and a keyword list can serve as its primary matching element. Placing Tailspin, Litware, and Falcon in the same keyword list allows the sensitive information type to match content containing those keywords.

Creating custom trainable classifiers is a compliance-management function. The Compliance Administrator role grants the relevant compliance configuration authority without the tenant-wide power of Global Administrator. Security Administrator and Security Operator focus on security operations rather than classifier creation.

DLP user notifications and policy tips are supported across the listed Outlook experiences. A matching message can therefore display the policy tip in Outlook on the web, the Outlook Win32 desktop client, and Outlook for iOS and Android. Limiting the result to only one or two of those client families would omit supported notification surfaces.

Box 1: Yes Retention1 is applied to File1 - Yes File1 is stored in Microsoft Exchange Online. According to the auto-labeling policy settings, Exchange email is included in the locations where the label will be applied. Additionally, File1 contains sensitive information types (SITs) that meet the conditions for IP Address (instance count 1) and SWIFT Code (instance count 2), which align with the requirements in Group1. Therefore, Retention1 will be applied to File1.

Box 2: Yes Retention1 is applied to File2 - Yes File2 is stored in Microsoft SharePoint Online, which is enabled in the locations for the auto-labeling policy. File2 meets the criteria in Group1 (IP Address with instance count 3 and SWIFT Code with instance count 5), thus satisfying the auto-labeling conditions. Retention1 will be applied to File2.

Box 3: Retention1 is applied to File3 - No Although File3 contains the required sensitive information types (IP Address and SWIFT Code), it is stored in Microsoft OneDrive, which is not included in the configured locations for auto-labeling in the policy. Since OneDrive is disabled in the locations for the policy, Retention1 will not be applied to File3.

An auto-labeling policy for a retention label can inspect supported content stored in OneDrive accounts and apply Label1 when its conditions match. Microsoft Entra security groups are identities rather than content repositories, while Defender for Cloud Apps and Teams chats are not the applicable auto-labeling location for this retention label.

A priority user group identifies users whose insider-risk activity requires focused handling and can limit related event visibility to designated reviewers. Adding User1 to such a group supports the required restricted review of User1's events. Exclusions, indicator variants, and detection groups do not provide that priority-user visibility boundary.

Communication compliance evaluates user communications for defined policy conditions and supports reviewing Microsoft 365 Copilot prompts and responses. A policy using the Protected Materials trainable classifier can therefore surface matching interactions for review. DLP enforces data handling, while retention and insider risk policies address different outcomes.

References:

A trainable classifier categorizes documents by their overall meaning and structure, making it suitable for recognizing resumes that contain work experience, education, and accomplishments. It avoids maintaining extensive keyword rules and can classify the large English document collection with less administrative effort.

A sensitivity auto-labeling policy links detection of the Credit Card Number sensitive information type to application of Confidential - Finance. Its locations must include Exchange email, SharePoint sites, and OneDrive accounts so all specified content is evaluated. Running the policy in simulation evaluates the matches without placing the label into active enforcement.

Box 1: To include the sensitive info type detected for each DLP rule match, you need to add a custom column in Activity Explorer. This ensures that the exported file contains specific details about the detected sensitive information types.

Box 2: DLP activity exports from Activity Explorer are always in CSV (Comma-Separated Values) format.
This format allows for easy data analysis and reporting in Excel or other data-processing tools.

Box 1: Data leaks When using a Data leaks template, you can assign a DLP policy to trigger indicators in the insider risk policy for high severity alerts in your organization. Whenever a high severity alert is generated by a DLP policy rule is added to the Office 365 audit log, insider risk policies created with this template automatically examine the high severity DLP alert. If the alert contains an in-scope user defined in the insider risk policy, the alert is processed by the insider risk policy as a new alert and assigned an insider risk severity and risk score. You can also choose to assign selected indicators as triggering events for a policy. This flexibility and customization helps scope the policy to only the activities covered by the indicators. This policy allows you to evaluate this alert in context with other activities included in the case.

Box 2: A data loss prevention (DLP) policy

Note: Data leaks Protecting data and preventing data leaks is a constant challenge for most organizations, particularly with the rapid growth of new data created by users, devices, and services. Users are empowered to create, store, and share information across services and devices that make managing data leaks increasingly more complex and difficult. Data leaks can include *accidental oversharing of information outside your organization* or data theft with malicious intent. With an assigned Microsoft Purview Data Loss Prevention (DLP) policy, built-in, or customizable triggering events, this template starts scoring real-time detections of suspicious SharePoint Online data downloads, file and folder sharing, printing files, and copying data to personal cloud messaging and storage services.

References:

The Exchange workload must supply its auditing events before mailbox sign-in activity can appear in the Microsoft Purview audit results. Running Set-AuditConfig -Workload Exchange enables that Exchange auditing configuration, allowing future sign-in events for User1's mailbox to be available for investigation.

The policy scope must identify the trader participants and the selected email and Teams channels. Its detection settings identify risky messages, the review percentage limits sampling to 50 percent, and the reviewer assignment sends those sampled matches to the named people for evaluation.

Box 1: Yes Yes - SIT1 will identity and match the content in Email1.

Prd:1234 will match the regular expression of SIT1.

Box 2: Yes Yes - SIT2 will identity and match the content in Email2.

111-111-1111 will match the exclusion of SIT2. However, 123456789012 will match the regular expression of SIT2.

Note: Sensitive information type additional checks Here are the definitions and some examples for the available additional checks.

* Exclude specific matches: This check lets you define keywords to exclude when detecting matches for the pattern you're editing. For example, you might exclude test credit card numbers like '4111111111111111' so that they're not matched as a valid number.

Box 3: No No - SIT3 will identity and match the content in Email3.

The full credit card number is not inclued in Email3.

Note: Sensitive information types (SIT) can use functions as primary elements for identifying sensitive items. For example, the Credit Card Number SIT uses the Func_credit_card function to detect credit card number.

References:

DLP policies are evaluated by priority, with priority 0 processed first. DLP1 currently has priority 0, and Rule1 stops additional DLP policy and rule processing when it matches, preventing Rule2 from supplying Tip 2. Moving DLP2 to priority 0 makes Rule2 run before that stopping rule. Because Rule2 allows additional processing, its Tip 2 can be presented while later evaluation continues.

A preservation lock makes the retention policy immutable in the required direction: the policy cannot be disabled or deleted, and included labels cannot be removed. The locked policy can still be made more restrictive by adding labels. This combination directly provides the requested administrative safeguards for the retention label policy.

Step 1 Review scenario
You created a retention label policy Contoso_Policy.
Status shows Off (Error) with message: "It's taking longer than expected to deploy the policy."
Requirement: Reinitiate the policy.

Step 2 Correct PowerShell cmdlet
To manage retention label policies in Microsoft Purview (compliance), the cmdlet is: Set-RetentionCompliancePolicy Other cmdlets: Set-RetentionPolicy # Legacy Exchange Online retention policies, not Purview label policies.
Start-EdgeSynchronization # Sync for Edge Transport servers, not retention.
Start-RetentionAutoTagLearning # Used for auto-tagging learning, not relevant here.

Step 3 Correct parameter
To force redistribution of a retention label policy when deployment fails, the parameter is: RetryDistribution Other options: ForceFullSync and -FullCrawl # Apply to search/crawl, not retention.
Train # Related to auto-tagging learning models, not retention.
Final Verified Answer
Set-RetentionCompliancePolicy d Contoso_Policy etryDistribution

References:
Set-RetentionCompliancePolicy (Microsoft Purview PowerShell)

Box 1: Security policy violations by risky users Contain risk indicators and scoring for when a user receives a poor performance review.

Security policy violations by risky users Users that experience employment stressors might be at a higher risk for inadvertent or malicious security policy violations. These stressors could include a user being placed on a performance improvement plan, having a poor performance review, or experiencing a demotion. This policy template starts risk scoring based on these indicators and activities associated with these types of events.

Box 2: Security policy violations Contain risk indicators and scoring for when a user disables security features on a device.

Security policy violations In many organizations, users have permission to install software on their devices or to modify device settings to help with their tasks. Either inadvertently or with malicious intent, users might install malware or *disable important security features* that help protect information on their device or on your network resources. This policy template uses security alerts from Microsoft Defender for Endpoint to start scoring these activities and focus detection and alerts to this risk area. Use this template to provide insights for security policy violations in scenarios when users might have a history of security policy violations that might be an indicator of insider risk.

References:
https://learn.microsoft.com/en-us/purview/insider-risk-management-policy-templates

Box 1: No File1 has two IP addresses in it. Both Tip2 and Tip3 rules matches. Tip2 has higher priority.

Note: For the hosted service workloads, like Exchange Online, SharePoint Online and OneDrive for Business, each rule is assigned a priority in the order in which it's created. That means, the rule created first has first priority, the rule created second has second priority, and so on.

When content is evaluated against rules, the rules are processed in priority order. If content matches multiple rules, the first rule evaluated that has the most restrictive action is enforced.

Box 2: Yes File2 has six IP addresses in it. Only Rule3 matches.

Box 3: Yes File3 has four IP addresses in it. Both Rule2 and Rule3 matches. Rule2 has higher priority.

References:

Box 1: delete the file before January 1, 2025 If you create a file in the Microsoft SharePoint library on January 1, 2025, and apply Label1 to the file, you can_____

Box 2: be deleted automatically on March 15, 2027 If you create a file in the Microsoft SharePoint library on March 15, 2025, and apply Label1 to the file, you can_____

Incorrect:
* always remain in the library, remain in the library until you delete the file It will remain for two years, and then it be deleted automatically.

Note: Retention settings that you configure can help you achieve these goals. Managing content commonly requires two actions: Retain content Prevent permanent deletion and remain available for eDiscovery Delete content Permanently delete content from your organization

With these two retention actions, you can configure retention settings for the following outcomes:

Retain-only: Retain content forever or for a specified period of time.
Delete-only: Permanently delete content after a specified period of time. *-> Retain and then delete: Retain content for a specified period of time and then permanently delete it.

References:

Box 1: Content Explorer Increase classifier accuracy Classifiers, like sensitive information types (SIT) and trainable classifiers are used in various kinds of policies to identify sensitive information. Like most such models, sometimes they identify an item as being sensitive that isn't. Or, they may not identify an item as being sensitive when it actually is. These are called false positives and false negatives.

This article shows you how to confirm whether items matched by a classifier are true positive (a Match) or a false positive (Not a match) and provide Match/Not a match feedback. You can use that feedback to tune your classifiers to increase accuracy. You can also send redacted versions of the document as well as the Match, Not a Match feedback to Microsoft if you want to help increase the accuracy of the classifiers that Microsoft provides.

The Match, Not a match experience is available in:

* -> Content Explorer Sensitive Information Type Matched Items page Trainable Classifier Matched Items page Microsoft Purview Data Loss Prevention (DLP) Alerts page

Box 2: Compliance data administrator Permissions In order to get access to the content explorer tab, an account must be assigned membership in any one of these roles or role groups.

Microsoft 365 role groups Global administrator Compliance administrator Security administrator *-> Compliance data administrator

References:

The restriction is required for exactly two hosts, so the Service domains list should contain web1.contoso.com and web2.contoso.com. Explicit entries cover both named websites without extending the restriction to every service beneath contoso.com, which keeps the configuration precise and limited in scope.

A browser-upload destination must be classified in Endpoint DLP settings before a policy rule can restrict transfers to it. Adding fabrikam.com to a sensitive service domain group makes that destination available to Endpoint DLP rules. A later policy can then use the group to restrict browser uploads to the specified domain.

If unallowed browsers are not configured, browser-dependent enforcement can differ and allow some uploads outside the intended controlled path. File path exclusions create another variation because files stored in excluded locations are exempt from Endpoint DLP evaluation. Either condition can produce intermittent upload behavior.

Viewing and exporting both insider risk alerts and cases are investigation activities. The Insider Risk Management Investigators role group is scoped to working with those records and their case data. It therefore supplies the requested operational access without adding policy configuration or administrative permissions that Group1 does not need.

Box 1: Since you are looking for a specific pattern (PA followed by eight digits, e.g., PA 12345678), the best classification method is Sensitive Info Type. Sensitive Info Types allow pattern-based matching to identify structured data. Exact Data Match (EDM) is not needed because you're not comparing against a fixed dataset. Trainable classifier is not appropriate because this is a structured pattern, not an unstructured document classification.

Box 2: Since PA 12345678 follows a structured pattern, the most effective method is Regular Expression (Regex). A Regular Expression (Regex) can be written to match "PA" followed by exactly eight digits (e.g.,
PA\s\d{8}). Keyword dictionary is not ideal because it works for predefined words, not number patterns.
Function is unnecessary because there is no need for checksum validation or predefined validation rules.

Encrypted-message expiration is configured through a custom branding template in Microsoft Purview Advanced Message Encryption. The template holds the expiration behavior that will apply to external recipients. After creating it, a mail flow rule can select the qualifying messages and invoke that configuration, making the custom template the first requirement.

A Defender file policy can inspect files in OneDrive, evaluate sensitive-content criteria, and detect when matching documents are shared externally. The policy can then generate the required alert. An activity policy tracks actions more generally, while a search does not provide continuous alerting.