Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Microsoft
Exam Format
Registration
Validity
Skills this practice test covers
- Turn an organization's sensitive data needs into built-in or custom sensitive info types.
- Create sensitivity labels with encryption and content marking, then publish them with a label policy.
- Build data loss prevention policies for Microsoft 365 locations and for devices with Endpoint DLP.
- Plan retention and disposition with retention labels, label policies and adaptive scopes.
- Set up Insider Risk Management with connectors, policy indicators and a policy template.
- Investigate user activity with Microsoft Purview Audit and Activity explorer.
Explore related topics
SC-401 exam content
3 domains · 9 topics · 183 of 355 questions are written for SC-401
Implement information protection64 questions
This domain starts with finding sensitive data and ends with protecting it wherever it goes. Candidates classify content, design sensitivity labels and extend protection to Windows files, on-premises file shares and Exchange mail.
Skills tested
- Create custom sensitive info types and implement document fingerprinting.
- Create and manage trainable classifiers and exact data match classifiers.
- Configure label protection settings, content marking and auto-labeling policies.
- Apply bulk classification to on-premises files with the Microsoft Purview Information Protection scanner.
- Design Microsoft Purview Message Encryption for outgoing mail.
Questions by topic
- Implement and manage data classification25
- Implement information protection for Windows, file shares, and Exchange17
- Implement and manage sensitivity labels in Microsoft Purview22
Implement data loss prevention and retention59 questions
This domain controls where data can go and how long it stays. Candidates design DLP policies for cloud workloads and devices, then plan retention and disposition so content is kept or deleted on schedule.
Skills tested
- Design DLP policies from an organization's requirements and assign the roles to run them.
- Specify device requirements for Endpoint DLP and configure its settings and advanced rules.
- Configure DLP policies for Adaptive Protection and just-in-time protection.
- Create retention labels and publish or auto-apply them with a retention label policy.
- Interpret policy precedence with Policy lookup and recover retained content.
Questions by topic
- Implement and monitor Microsoft Purview Endpoint DLP13
- Implement and manage retention27
- Create and configure data loss prevention policies19
Manage risks, alerts, and activities60 questions
This domain covers watching and responding. Candidates set up Insider Risk Management, investigate activity in audit logs and respond to alerts, and they protect content that AI services such as Microsoft 365 Copilot can reach.
Skills tested
- Plan Insider Risk Management connectors and integration with Microsoft Defender for Endpoint.
- Configure policy indicators, forensic evidence settings and notice templates.
- Assign Microsoft Purview Audit (Premium) licenses and configure audit retention policies.
- Respond to Purview alerts in Microsoft Defender XDR and to DLP alerts in the Microsoft Purview portal.
- Implement the prerequisites, roles and policies for DSPM for AI.
Questions by topic
- Implement and manage Microsoft Purview Insider Risk Management24
- Protect data used by AI services14
- Manage information security alerts and activities22
Requirements
- No formal prerequisites: anyone can book the exam.
- Recommended: familiarity with all Microsoft 365 services and with PowerShell.
- Recommended: experience with Microsoft Entra, the Microsoft Defender portal and Microsoft Defender for Cloud Apps.
About the SC-401 exam
SC-401 checks whether an administrator can use Microsoft Purview to classify, protect and govern the data that a company keeps in Microsoft 365. It has three domains: information protection, data loss prevention (DLP) and retention, and risks, alerts and activities. The tasks include classifying data, labelling it, stopping it from leaving, keeping it for the right time and watching for insider risk. Newer objectives also cover data used by AI services, through Data Security Posture Management (DSPM) for AI. Passing earns the Microsoft Certified: Information Security Administrator Associate certification.
The PlanetCert practice test spreads its questions across all three domains, with the most in information protection. The explanations say why one setting wins over another, for example which DLP rule applies when two policies match the same file. Study Mode suits the retention questions, where label policies, retention policies and policy precedence are easy to confuse. Brainy AI Assistant can compare exact data match with document fingerprinting, or explain what an Insider Risk Management connector adds to a policy.
How to earn the certification
- Earns
- Microsoft Certified: Information Security Administrator AssociateAssociate
The certification is valid for one year, and Microsoft renews it for free when the holder passes an online assessment on Microsoft Learn.
How to prepare for SC-401
- 1
Open a Purview trial tenant
Use a Microsoft 365 tenant with Microsoft Purview, a few test users and a Windows device. Most SC-401 objectives are settings in the Microsoft Purview portal, so trying each one by hand helps.
- 2
Build labels before DLP
Create sensitive info types and sensitivity labels first. DLP and auto-labeling policies use them as conditions, so the information protection domain is the base for the rest.
- 3
Map retention precedence on paper
Write down which retention policy or label wins when several apply to one item, then check the answer with Policy lookup. This is one of the hardest parts of the DLP and retention domain.
- 4
Walk an insider risk case
Turn on Insider Risk Management, pick a policy template and set indicators. Follow one alert into a case, then look for the same activity in Purview Audit and Activity explorer.
- 5
Practise by domain, then mixed
Work through the SC-401 practice test one domain at a time and read every explanation. Then take a full mixed run, and repeat missed DLP or retention settings in the trial tenant.
Start a timed SC-401run
Who SC-401 is for
- Administrators who run Microsoft Purview to guard company data in Microsoft 365.
- Microsoft 365 administrators who now own labelling, DLP or retention settings.
- Compliance staff who investigate insider risk cases and audit records.
- Administrators who must control what data AI services such as Microsoft 365 Copilot can reach.
Typical job titles: Information security administrator · Microsoft 365 administrator · Compliance administrator · Data protection specialist · Security engineer
SC-401 glossary
19 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- Activity explorer
- A Purview view that lists actions taken on labelled and classified content, such as a label being changed or removed.
- Adaptive Protection
- A feature that gives users an insider risk level and makes DLP policies stricter for users with a higher level.
- Content marking
- A label setting that adds a header, footer or watermark to a labelled document or email.
- Document fingerprinting
- A method that turns a standard form or template into a sensitive info type, so that filled-in copies of that form can be found.
- DSPM for AI
- Data Security Posture Management for AI: a Purview hub that shows and controls how AI apps, such as Copilot, use sensitive data.
- eDiscovery
- The Purview tools that search, hold and export content in Microsoft 365 for legal cases or investigations.
- Endpoint DLP
- Data loss prevention on devices, which can block actions such as copying a sensitive file to a USB drive.
- Insider Risk Management
- A Purview solution that finds risky actions by people inside the organization, such as data theft by a leaving employee.
- Just-in-time protection
- An Endpoint DLP setting that controls actions on files while the device has not yet finished checking them against policy.
- Microsoft Defender XDR
- Microsoft's security portal that brings alerts together, including alerts raised by Purview DLP and insider risk.
- Microsoft Purview Audit (Premium)
- The higher audit tier, which keeps audit logs longer and records more events; users need a licence for it.
- Microsoft Purview Information Protection scanner
- A tool that finds, classifies and labels files on on-premises file shares and SharePoint servers in bulk.
- Microsoft Purview Message Encryption
- A service that encrypts email so that only the intended people can read it, inside or outside the organization.
- Policy indicators
- The user activities that Insider Risk Management watches and scores, such as downloading or sharing many files.
- Policy lookup
- A Purview tool that shows which retention policies and labels apply to a user, site or group.
- Retention labels
- Labels applied to single items that keep them, delete them, or both, after a set period.
- Sensitive info types
- Patterns that Microsoft Purview uses to find sensitive data in content, such as a credit card number. Some are built in, and administrators can create custom ones.
- Sensitivity labels
- Labels that mark how sensitive an item or container is, and that can add encryption and visual markings to it.
- Trainable classifiers
- Classifiers that learn to recognize a kind of content, such as contracts, from examples instead of from fixed patterns.