Microsoft Certification
255 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Microsoft Administering Information Security in Microsoft 365 (SC-401) certification validates professional expertise in Microsoft technologies. This study guide covers all 255 practice questions from our SC-401 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
You are configuring a sensitivity label to protect confidential project files. You want to ensure that users are prompted to provide a justification if they try to downgrade or remove the label. What must you configure?
The requirement for users to provide a justification when downgrading, replacing, or removing a sensitivity label is configured in the sensitivity label policy (publishing policy), not in the label itself.
Your organization uses Microsoft 365 Copilot. You want to ensure that if Copilot references a document labeled as 'Highly Confidential', the AI-generated response also receives the same level of protection. Which feature handles this?
Microsoft 365 Copilot automatically honors and inherits sensitivity labels. If Copilot uses labeled data to generate a response, the output automatically inherits the highest priority sensitivity label of the source files.
You need to create a custom sensitive information type (SIT) that identifies customer account numbers based on a static list of 100,000 specific known account numbers. Which method should you use?
Exact Data Match (EDM) is designed to identify sensitive information based on exact matches against a large, securely hashed database of known values (like a specific list of 100,000 account numbers).
When creating a Trainable Classifier in Microsoft Purview, what is the minimum number of positive samples (seed data) required to start the training process?
To train a custom trainable classifier, you must provide a minimum of 50 positive samples (documents that strongly represent the category) to begin the initial training phase.
You are implementing Endpoint DLP to monitor files copied to USB drives. However, policies are not applying to several Windows 11 devices. What is the most likely prerequisite missing?
Endpoint DLP requires devices to be onboarded to the Microsoft Purview portal. This is typically done via Microsoft Defender for Endpoint onboarding, Microsoft Intune, or local scripts. The Information Protection client is not required for Endpoint DLP.
Your company wants to dynamically restrict users' ability to share files externally based on their current risk level (e.g., if a user suddenly starts downloading gigabytes of data). Which feature should you integrate with DLP?
Adaptive Protection dynamically adjusts Data Loss Prevention (DLP) policy rules based on the user's calculated risk level in Insider Risk Management. High-risk users can face block actions, while low-risk users face warnings.
You are creating a DLP policy to protect data in Microsoft Teams. Which two locations can be targeted for Teams DLP?
DLP for Microsoft Teams specifically monitors and protects text shared within Teams chats and channel messages. Files shared in Teams are covered by SharePoint and OneDrive DLP locations.
To ensure privacy compliance, you need to obscure the actual usernames in the Insider Risk Management alerts dashboard. Where do you configure this?
Anonymization of user identities (showing pseudonyms instead of actual usernames) is configured globally in the Insider Risk Management settings under the Privacy section.
You want to auto-apply a sensitivity label to documents stored in SharePoint Online that contain credit card numbers. Which requirement must be met for auto-labeling at rest to work?
Auto-labeling policies for data at rest (SharePoint, OneDrive, Exchange) must successfully complete a simulation phase before they can be officially turned on to apply labels automatically.
You are setting up an Exact Data Match (EDM) sensitive information type. Which tool is used to hash the sensitive data locally before uploading it to Microsoft Purview?
The EDM Upload Agent is a command-line tool used to read your local data source, securely hash the sensitive data (using a salt), and upload only the hashes to Microsoft Purview.
A user attempts to send an email containing a Social Security Number (SSN). A DLP policy blocks the email and generates an incident. Where in Microsoft Purview should you go to review the actual content that triggered the policy?
DLP Alerts in the Microsoft Purview compliance portal provide the incident details. If configured, administrators with the 'Data Classification Content Viewer' role can view the source file or email content that triggered the alert.
You are deploying sensitivity labels. Label A has a priority of 1. Label B has a priority of 5. Label C has a priority of 10. Which label represents the highest level of sensitivity and restrictive permissions?
In Microsoft Purview, a higher priority number indicates a higher level of sensitivity. Therefore, Label C (Priority 10) is considered more sensitive than Label A (Priority 1).
You configure a DLP policy for Endpoint devices. You want to prevent users from copying sensitive files to network shares. Which action should you select in the Endpoint DLP rule?
In Endpoint DLP, actions are specific to device operations. To prevent copying to a network share, you configure the 'Audit or restrict activities on Windows devices' setting and select the 'Copy to a network share' action.
Which connector must you configure in Microsoft Purview to correlate user resignation dates with potential data theft activities in Insider Risk Management?
The HR data connector allows you to import human resources data (like resignation dates, performance improvement plans) to trigger Insider Risk Management policies, such as 'Data theft by departing users'.
You need to protect standard forms (like an employee tax form) filled out by users. You want Purview to recognize the blank layout of the form and detect when a filled-out version is shared. Which feature should you use?
Document fingerprinting converts a standard form (a blank template) into a sensitive information type. Purview can then detect documents that match the structure of that template, even if users have filled in the blank fields.
What role is required to view the actual sensitive content (e.g., the exact credit card number) inside documents identified by Content Explorer?
Because viewing sensitive data is a high-risk action, administrators must be explicitly assigned the 'Data Classification Content Viewer' role. Standard Compliance Admins can only see metadata and locations, not the actual content.
A sensitivity label applies encryption to a document. Which technology underlying Microsoft 365 handles the actual encryption and decryption of the file?
Sensitivity labels use Azure Rights Management (Azure RMS), a component of Azure Information Protection, to apply encryption, enforce usage rights, and control access to labeled documents and emails.
You want to configure an Insider Risk Management policy to detect data exfiltration. However, no indicators are showing up in the portal. What is the most likely cause?
Before Insider Risk Management policies can generate alerts, you must explicitly select and turn on the specific policy indicators (e.g., downloading files, copying to USB) in the global settings.
In an Exact Data Match (EDM) schema, what does it mean when a field is marked as 'searchable'?
In an EDM schema, 'searchable' fields are the primary elements that Purview looks for in content. If a searchable field is found, Purview then checks for corroborating evidence in the same document.
Which report in Microsoft Purview provides a high-level overview of how much sensitive data is stored across Exchange, SharePoint, and OneDrive, and what labels are applied?
The Data classification overview dashboard provides a high-level summary of sensitive information types, retention labels, and sensitivity labels detected across your Microsoft 365 environment.
A user copies a file from their local machine to a personal Dropbox account via a web browser. Which Microsoft Purview feature can detect and block this activity?
Endpoint DLP monitors and controls actions taken on Windows and macOS endpoints, including copying sensitive files to unsupported web browsers, USB drives, or network shares.
When configuring a sensitivity label, you enable 'Apply content marking'. Which of the following can be added to the document automatically?
Content marking via sensitivity labels allows you to automatically stamp the document with a watermark, a header, or a footer to visually indicate its sensitivity to the user.
You want to create a DLP policy that applies strictly to users in the 'Finance' group. Where do you define this scope?
When configuring the locations for a DLP policy (e.g., Exchange email, OneDrive accounts), you can scope the policy to include or exclude specific distribution groups, mail-enabled security groups, or specific users.
Your organization uses Microsoft Purview AI Hub. What is its primary purpose in the context of information security?
The Purview AI Hub provides visibility and control over how users interact with AI applications. It helps administrators monitor AI usage and apply policies to prevent sensitive data from being shared with or generated by AI tools.
You need to prevent employees from taking screenshots of a document labeled 'Top Secret'. How should the sensitivity label be configured?
To prevent screenshotting (on supported platforms/apps) and copying text, the sensitivity label must apply encryption and ensure that the 'Copy and extract content' right is NOT granted to the users.
What is required to allow Endpoint DLP to monitor files on macOS devices?
Endpoint DLP supports macOS. It requires the device to be onboarded via Microsoft Defender for Endpoint, and you must grant specific privacy permissions, such as Full Disk Access, to the Defender agent on the Mac.
In Insider Risk Management, what triggers the start of a policy evaluation for a specific user?
Insider Risk policies do not monitor everyone all the time by default. A user is brought into the scope of a policy (starts being evaluated) only when a 'triggering event' occurs, such as a DLP alert or receiving data from the HR connector.
Which feature allows you to see a historical timeline of a file's journey—who created it, what labels were applied, and where it was copied—across endpoints?
Activity explorer provides historical visibility into activities related to sensitive data and labels. It shows what actions were taken on files (e.g., label applied, file copied to USB) over a period of time.
You want to define a custom sensitive information type (SIT) using a Keyword Dictionary. What is the maximum size (uncompressed) for a keyword dictionary file in Microsoft Purview?
When creating a keyword dictionary for a custom SIT, the text file containing the keywords cannot exceed 1 MB (uncompressed), which equates to roughly 100,000 to 200,000 words depending on character length.
A user needs to collaborate on an encrypted document with an external partner. The sensitivity label uses 'Assign permissions now'. Can the external partner open the file?
Encryption applied by sensitivity labels can grant access to external users. The administrator must add the external user's email address or domain to the permission settings of the label when configuring 'Assign permissions now'.
What happens if a document matches the conditions of two different auto-labeling policies at rest in SharePoint?
If a document qualifies for multiple sensitivity labels via auto-labeling, Microsoft Purview resolves the conflict by applying the label that has the highest priority value (where 10 is higher than 1).
You are designing an Insider Risk Management (IRM) workflow. Which role is explicitly required to create IRM policies and view alerts?
By design, Global Admins do NOT have access to Insider Risk Management features to protect privacy. You must explicitly assign the 'Insider Risk Management' or 'Insider Risk Management Admin' role group.
You want to block users from pasting sensitive data into ChatGPT. Which Endpoint DLP action should you configure?
To prevent pasting sensitive data into web applications like ChatGPT on the endpoint, you must configure the Endpoint DLP action to restrict/block 'Copy to clipboard'.
When setting up Adaptive Protection, what are the three default risk levels assigned to users based on their activities?
Adaptive Protection dynamically assigns users to one of three risk levels: Elevated (High), Moderate (Medium), or Minor (Low). Note: The UI often reflects Elevated/Moderate/Minor, aligning with Low/Medium/High risk concepts in documentation.
A user removes a sensitivity label from an email in Outlook. Where is this downgrade activity logged so administrators can review it?
All sensitivity label activities, including applying, downgrading, or removing labels by users, are recorded in the Microsoft Purview Unified Audit Log, and can also be visualized in Activity Explorer.
You have multiple DLP rules within a single DLP policy. Rule A has a priority of 0. Rule B has a priority of 1. If a document matches the conditions for both rules, which action is applied?
In Microsoft Purview DLP, rules are evaluated in priority order starting from 0 (highest priority). If a match is found, the highest priority rule's actions are applied and processing for that policy stops.
You want to use Double Key Encryption (DKE) for your most sensitive files. Which of the following is a strict requirement for DKE?
DKE requires two keys: one in Azure and one you hold. To access a DKE-protected file, the user must be able to reach both key services to authenticate and decrypt the content.
You are reviewing Activity Explorer. How many days of historical data are available in the Activity Explorer view by default?
Activity Explorer natively displays up to 30 days of historical activity data regarding labels and sensitive information usage.
An employee attempts to print a document containing credit card numbers. You want to block this action on their Windows 11 laptop. Which feature must be configured?
Endpoint DLP extends data loss prevention capabilities to local Windows and macOS devices, allowing you to block actions like printing, copying to USB, or copying to the clipboard.
In Insider Risk Management, what is the purpose of the 'Forensic Evidence' feature?
Forensic evidence is an opt-in feature in IRM that captures screen clips (screenshots) of user endpoints during risky activities to provide undeniable visual context for investigators.
You are creating an Exact Data Match (EDM) schema. What is the maximum number of rows (records) supported by an EDM sensitive information type datastore?
An Exact Data Match (EDM) datastore in Microsoft Purview can support hashing and matching against up to 100 million rows of data.
A user complains that they cannot co-author an encrypted Word document in SharePoint Online with a colleague. What is the most likely missing prerequisite?
To allow multiple users to edit an encrypted document simultaneously (co-authoring), the administrator must explicitly enable the 'Co-authoring for files with sensitivity labels' setting in the Purview portal.
You want to apply a sensitivity label to a Microsoft Teams site so that all unmanaged devices are blocked from downloading files from that site. What type of label must you create?
Container-level sensitivity labels are applied to Microsoft 365 Groups, Teams, or SharePoint sites to enforce settings like privacy (Public/Private) and external device access policies.
Which Microsoft Purview role allows an investigator to view Insider Risk Management alerts but prevents them from configuring global IRM settings or viewing anonymized usernames?
The 'Insider Risk Management Investigator' role allows users to investigate alerts and cases, but they cannot configure policies or disable user anonymization.
You configure a DLP rule with an action to 'Restrict access or encrypt the content in Microsoft 365 locations'. You select 'Block everyone'. Who can still access the file?
When a DLP policy blocks access to a file in SharePoint or OneDrive, the default behavior still allows the file owner, the person who last modified the file, and the site administrator to access it.
What is the primary function of the Microsoft Purview Information Protection Scanner?
The AIP/Purview Information Protection Scanner is a service installed on Windows Server that crawls on-premises file shares (SMB) and SharePoint Server to apply sensitivity labels and classification.
A user is writing a prompt in Microsoft 365 Copilot and attaches a document labeled 'Confidential - Internal Only'. The user asks Copilot to summarize it. Who can see the summary generated by Copilot?
Copilot inherits the permissions of the source data. If it uses an encrypted document, the generated response is also protected, and only users with rights to the original document can view the Copilot output.
You are creating a custom Sensitive Information Type (SIT) using a regular expression. Which additional element is highly recommended to reduce false positives?
To increase confidence and reduce false positives in custom SITs, you should define a supporting element (like the keyword 'Visa' or 'Account') that must be found within a specific character proximity to the regex match.
In Adaptive Protection, a user's risk level is dynamically elevated to 'High'. How long does the user remain at this high risk level?
Adaptive Protection is dynamic. A user's risk level automatically adjusts based on their ongoing activities evaluated by the Insider Risk Management model, ensuring restrictions apply only while the risk is present.
You want to deploy an Endpoint DLP policy that stops users from uploading sensitive files to personal cloud storage domains (e.g., dropbox.com). Which Endpoint DLP setting should you configure?
In Endpoint DLP settings, 'Service domains' allows you to define specific cloud domains (like dropbox.com) and either block or allow sensitive data to be uploaded to them from a managed endpoint.
When setting up an Insider Risk Management policy for 'Data theft by departing users', what defines a user as 'departing'?
The 'Data theft by departing users' IRM policy strictly relies on the Microsoft Purview HR data connector to receive official resignation or termination dates to trigger the policy evaluation.
You are applying a sensitivity label via an auto-labeling policy. Can an auto-labeling policy overwrite a sensitivity label that was manually applied by a user?
By default, Microsoft Purview respects user intent. An auto-labeling policy will never overwrite a sensitivity label that was manually applied by a user.
You need to prevent users from copying sensitive text from an email in Outlook and pasting it into a third-party app like Notepad. Which policy handles this?
To prevent copying and pasting text directly out of an encrypted email or document, you use a Sensitivity Label that applies encryption and explicitly removes the 'Copy' (EXTRACT) usage right.
A user receives a DLP policy tip warning them that their email contains sensitive data. The policy is configured to 'Allow overrides'. What happens if the user overrides the policy?
When overrides are allowed, the user can provide a business justification (if required) and send the email. This action is logged as an override event in the Purview compliance portal for auditing.
What is the primary difference between a Trainable Classifier and a custom Sensitive Information Type (SIT)?
SITs are pattern-based (Regex, keywords, EDM). Trainable Classifiers use AI/ML to categorize documents based on their overall context and meaning (e.g., recognizing an 'Invoice' or 'Source Code').
In Content Explorer, you notice a folder containing 500 instances of credit card numbers. You click on a file to read the contents, but the preview is blocked. Why?
To physically open and read the contents of a sensitive file within Content Explorer, your account must be explicitly granted the 'Data Classification Content Viewer' role, independent of your admin privileges.
You want to create a default sensitivity label for an entire SharePoint Document Library. All newly created or modified files in that library should automatically receive this label. What is required?
SharePoint Online allows site owners to configure a default sensitivity label for a document library, ensuring any new or modified file in that library receives the label automatically.
You are configuring Endpoint DLP and want to block users from transferring sensitive files via Bluetooth. Which settings menu do you use?
Blocking Bluetooth file transfers is an endpoint-level restriction configured within the DLP rule under the 'Audit or restrict activities on Windows devices' section.
When configuring a custom sensitive information type, you set the confidence level to 'High'. What does this mean?
A 'High' confidence level means the system requires stricter matching conditions (such as a regex match PLUS specific keywords nearby) before it confirms the data is sensitive, which minimizes false positives.
Which Microsoft 365 feature allows you to define custom 'Priority Users' (like the CEO or CFO) so that their risky activities generate higher severity alerts in Insider Risk Management?
Within Insider Risk Management settings, you can define Priority User Groups. Users in these groups are monitored more closely, and alerts generated by their activities often receive a higher severity rating.
An organization wants to require that every email sent internally has a sensitivity label applied. How is this enforced?
Mandatory labeling is enforced via the Sensitivity Label Publishing Policy. When enabled, users cannot save a document or send an email without selecting a sensitivity label.
You need to upload an updated dataset for an existing Exact Data Match (EDM) sensitive information type. Which tool must you use?
The EDM Upload Agent is used every time you need to hash and upload new or updated records to an existing Exact Data Match schema.
A DLP policy in Teams blocks a user from sending a message containing an SSN. Can the user override a Teams DLP block?
Like Exchange and Endpoint DLP, Teams DLP rules can be configured to allow users to override the block action by providing a business justification via a policy tip in the Teams chat interface.
What is the primary role of the Purview AI Hub?
The Purview AI Hub provides analytics on how users are interacting with AI tools (like Copilot or ChatGPT) and helps you deploy DLP and labeling policies to prevent sensitive data leakage to these AIs.
You are creating a DLP policy and want to test it without impacting users. Which mode should you select?
Simulation mode (Test it out) allows the DLP policy to run in the background, logging matches in the audit log and reports without actually blocking user actions or showing policy tips.
Which user identifier is shown by default in the Insider Risk Management alerts dashboard?
To prevent bias and protect privacy during the initial investigation phase, Insider Risk Management displays anonymized pseudonyms by default. De-anonymization requires specific administrative steps.
You want to create a document fingerprint of a blank NDA template. Which format must the template file be in for the fingerprinting engine to process it?
Document fingerprinting supports files that contain text, such as Word documents (.docx), PDFs, Excel files, and text files. It creates a hash of the word patterns within the document.
When configuring Endpoint DLP, what is an 'Unallowed App'?
Unallowed apps are executable files (defined by name or publisher) that you explicitly restrict from interacting with sensitive data, preventing users from using them to exfiltrate files.
A user sends an email to an external domain. The email contains a sensitivity label with encryption configured for 'Authenticated users'. Can a user with a Gmail account open it?
Microsoft Purview Message Encryption allows external users with any email address (like Gmail) to authenticate and read encrypted emails using a One-Time Passcode (OTP) or federation.
In an Insider Risk Management policy, what defines the 'Activation Window'?
When a triggering event (like a resignation) occurs, the Activation Window defines how long the IRM policy will actively monitor that specific user's activities (e.g., for the next 30 days).
Which Microsoft 365 license level is strictly required to utilize Exact Data Match (EDM) and Trainable Classifiers?
Advanced data classification features, including Exact Data Match (EDM), Trainable Classifiers, and Insider Risk Management, require a Microsoft 365 E5 license or the E5 Information Protection and Governance add-on.
You want to block users from copying sensitive files to a USB drive, but only if the USB drive is unencrypted. Which feature integrates with Endpoint DLP to achieve this?
Endpoint DLP can be configured to restrict copying files to removable media. It can integrate with BitLocker to allow copying ONLY if the target USB drive is encrypted by BitLocker.
You publish a new sensitivity label. How long does it typically take for the label to appear in the Office desktop apps for end-users?
After publishing a sensitivity label policy, it can take up to 24 hours for the labels to sync and appear in the Office desktop applications across the organization.
When configuring a Trainable Classifier, you must test its accuracy. What is the minimum number of 'test' documents (mixed positive and negative) required for the testing phase?
While you need 50 positive samples to seed the classifier, you need a minimum of 200 mixed documents (both matching and non-matching) to test and evaluate the classifier's accuracy.
A user removes a sensitivity label from a file. You want an alert sent to the security team immediately. Which policy type should you configure?
You can create a DLP policy where the condition is based on the presence (or removal) of a specific sensitivity label, and configure an Incident Report action to email the security team immediately.
In the context of Copilot and data security, what is 'Web Grounding'?
Web Grounding allows Copilot to access the public internet to enrich its responses. Administrators can restrict web grounding in Purview to ensure Copilot only uses internal, secure organizational data.
You are creating a sensitivity label policy. What is the purpose of a 'Sublabel'?
Sublabels allow you to group related labels logically. For example, a parent label 'Confidential' can have sublabels for 'All Employees' and 'Finance Only', providing granular rights management.
Can a parent sensitivity label apply encryption if it has active sublabels?
By design, if you create sublabels, the parent label can no longer be applied to documents or apply protection. Users must select one of the specific sublabels. The parent becomes just a category header.
Which PowerShell module is primarily used to manage Microsoft Purview compliance features, such as creating DLP policies via command line?
To manage Purview compliance features like DLP, labels, and SITs via PowerShell, administrators must use the ExchangeOnlineManagement module and connect to the Security & Compliance Center using `Connect-IPPSSession`.
You want to ensure that any document downloaded from an unmanaged device via SharePoint Online is automatically encrypted. What integration is required?
By integrating SharePoint Online with Microsoft Defender for Cloud Apps (Conditional Access App Control), you can create a session policy that automatically applies an encrypted sensitivity label to files when downloaded on unmanaged devices.
Which feature dynamically adjusts a user's Endpoint DLP restrictions based on their recent pattern of resigning and downloading large amounts of data?
Adaptive Protection bridges Insider Risk Management and DLP. It calculates a user's risk level based on behaviors (like resigning and downloading data) and dynamically applies stricter DLP rules to that specific user.
A user wants to classify a document using a Trainable Classifier. Can a user manually apply a Trainable Classifier to a document in Word?
Users do not manually select or apply SITs or Trainable Classifiers. These are backend mechanisms used by Purview policies (like auto-labeling or DLP) to automatically detect content.
You are configuring an Insider Risk Management policy. What is the maximum number of users you can explicitly assign to a single IRM policy?
You can scope an IRM policy to specific groups or include all users in the organization. There is no strict numerical limit on the number of users a policy can evaluate.
What is required to allow Endpoint DLP to parse and inspect the contents of a PDF file for sensitive information?
Endpoint DLP natively supports extracting and scanning text from common file formats, including PDF, DOCX, and XLSX, without requiring third-party PDF readers.
You want to prevent Copilot from accessing a specific SharePoint site entirely, regardless of the user's permissions. How do you achieve this?
Copilot relies heavily on the Microsoft Graph and the SharePoint search index. To completely hide a site from Copilot for all users, you must configure the site settings to exclude it from the search search results.
You need to ensure that DLP policies can detect credit card numbers embedded inside images (e.g., screenshots or photos) uploaded to SharePoint Online. What must you configure?
Microsoft Purview supports Optical Character Recognition (OCR) which can be enabled at the tenant level. Once enabled, DLP policies and auto-labeling policies can scan and detect sensitive information types inside image files (like JPG, PNG, TIFF).
You are organizing a highly confidential Microsoft Teams meeting. You want to enforce an end-to-end encrypted meeting and prevent attendees from copying text from the meeting chat. How can this be automated?
Sensitivity labels can be scoped to Microsoft Teams meetings. They can automatically enforce meeting options such as who can bypass the lobby, preventing copying from the chat, and enforcing end-to-end encryption for meeting video/audio.
Which Microsoft Purview feature is explicitly designed to monitor internal communications for threatening language, harassment, or regulatory compliance violations (like insider trading discussions)?
Communication Compliance evaluates email, Teams messages, and Yammer communications to detect inappropriate content, threatening language, and regulatory violations using built-in classifiers.
In an Insider Risk Management (IRM) policy, what is a 'Sequence'?
Sequence detection in IRM uses machine learning to identify a chain of related risky activities across different vectors (device, cloud, email) that collectively indicate a higher intent of data theft.
You want to block users from downloading sensitive files from SharePoint Online to personal, unmanaged Windows devices. Which solution provides this capability natively?
By integrating Entra ID Conditional Access with Defender for Cloud Apps, you can route sessions from unmanaged devices through a proxy (Conditional Access App Control) to actively block the download of sensitive files.
When setting up Exact Data Match (EDM), what hashing algorithm does the EDM Upload Agent use by default before transmitting the data to Microsoft 365?
The EDM Upload Agent securely hashes your sensitive data locally using the SHA-256 algorithm (along with a salt) before uploading it, ensuring Microsoft never sees the raw plaintext data.
Your company uses a specific third-party PDF editor. You want to ensure Endpoint DLP monitors this app when it accesses sensitive files. Where do you add this application?
To control or monitor how a specific application interacts with sensitive data, you define it in the Endpoint DLP settings under 'Unallowed apps' (or restricted apps), which allows DLP to govern its file access.
A user sends an email containing a sensitive document. A DLP rule is configured to generate an Incident Report. Who can receive this Incident Report?
When configuring a DLP rule to send an Incident Report, you can specify exactly who receives it by entering specific user email addresses, distribution lists, or shared mailboxes.
A sensitivity label is configured to 'Let users assign permissions when they apply the label' in Word. What specific options does the user see?
User-defined permissions allow the end-user to explicitly state who gets access. In Outlook, this surfaces as 'Do Not Forward' or 'Encrypt-Only'. In Word/Excel/PowerPoint, a dialog box allows them to pick specific users and assign Read or Change rights.
What is the primary function of the 'Physical badging' connector in Insider Risk Management?
The physical badging connector imports access control data from your building systems. IRM uses this to correlate unusual physical access (e.g., entering the office at 3 AM) with digital anomalies (e.g., downloading large datasets).
You want to block the upload of sensitive files to all personal cloud storage websites via Endpoint DLP, except for one specific domain (e.g., approved-partner.com) which should be allowed. How do you configure this?
Endpoint DLP 'Service domains' settings allow you to define granular controls. You can block uploads via unallowed browsers globally, while specifically whitelisting certain service domains to allow data flow.
How does Microsoft 365 Copilot handle a prompt if the user asks a question about a document they do not have read access to?
Copilot strictly enforces existing Microsoft 365 permissions (including Entra ID and sensitivity labels). If a user does not have access to a file, Copilot cannot see it or use it as grounding data.
You are creating a Trainable Classifier. You have provided 50 positive samples and 200 mixed test samples. The training completes, but the accuracy is only 40%. What is the next step?
If a trainable classifier has low accuracy after the initial training, you must perform iterative retraining by reviewing the test matches, confirming which are correct or incorrect, and running the training cycle again.
You want to monitor users who are accessing non-approved Generative AI sites (like external ChatGPT or Claude). Which tool in Microsoft Purview provides this visibility?
The Purview AI Hub integrates with Microsoft Defender for Cloud Apps (Shadow IT discovery) to identify and categorize all AI-related cloud applications being accessed by users on your network.
In a Data Loss Prevention (DLP) policy, what is a 'Condition Exception'?
Exceptions in DLP rules allow you to exclude specific scenarios from being blocked. For example, 'Block sending SSNs outside the organization, EXCEPT if the recipient domain is mypartner.com'.
A user modifies a document in SharePoint. A sensitivity label with auto-labeling is configured. How quickly is the auto-labeling policy applied to data at rest?
Auto-labeling policies for data at rest (SharePoint/OneDrive) rely on search indexing and backend processing. It is not instantaneous and can take several days (up to 7 days) to crawl and label existing or newly modified files.
You are creating an Exact Data Match (EDM) schema. You must define a primary field. Which of the following is the best candidate for a primary field?
A primary field in EDM must be a unique, highly identifiable piece of data that can be strictly matched (like a Social Security Number, Customer ID, or Medical Record Number). 'First Name' or 'City' are too generic and cause false positives.
Which tool provides a unified view of all sensitive data matches, allowing an administrator with the correct permissions to browse through folders in SharePoint and Exchange to see the physical files containing the sensitive data?
Content Explorer provides a hierarchical, folder-like view of your M365 environment, showing exactly where sensitive information types and labels are located, and allows authorized users to read the source files.
You configure a DLP rule to block the sharing of medical records. You enable 'Show policy tips'. Where will the user see this policy tip?
Policy tips are designed to educate users in real-time. They appear directly within the UI of supported clients (Outlook, Word, Teams) while the user is composing the message or working on the document.
You want to prevent users from printing files that have a specific sensitivity label. Which Endpoint DLP action must you configure?
Endpoint DLP natively supports an action to 'Audit or restrict activities on Windows devices' which includes a specific control to 'Print' (Allow, Audit, Block, Block with override).
An Insider Risk Management policy triggers an alert. The investigator determines it is a severe incident that requires legal action. What is the correct next step within the Purview portal?
Purview provides a seamless workflow. Once an IRM case is deemed critical and requires legal or HR intervention, the investigator can click 'Escalate for investigation', which automatically creates an eDiscovery Premium case containing all the evidence.
You need to securely encrypt an email sent to a partner organization. You want to ensure the email cannot be forwarded by the recipient. Which default sensitivity label permission achieves this?
The 'Do Not Forward' permission applies encryption and explicitly strips the right for the recipient to forward, print, or copy content from the email.
Adaptive Protection dynamically assigns a user to a 'High' risk level. You have a DLP policy configured for 'High' risk users that blocks USB transfers. How quickly is this block enforced on the endpoint?
Adaptive Protection is designed to be highly responsive. Once the IRM engine elevates the user's risk level, the associated DLP policies dynamically apply the stricter actions to the endpoint almost immediately.
You are creating a custom dictionary for a Sensitive Information Type. Which file formats are supported for uploading a keyword dictionary?
When importing a custom keyword dictionary into Microsoft Purview, the file must be a simple text file (.txt) or a comma-separated values file (.csv).
A user reports that a Sensitivity Label is missing from their 'Sensitivity' button in Microsoft Word, but they can see it in Excel. What is the most likely cause?
Sensitivity label publishing policies apply to users/groups, not specific Office apps. If a label appears in Excel but not Word for the same user, it is typically a local client sync issue or cached token issue in that specific app.
In Endpoint DLP, you want to allow users to copy files to a specific, corporate-approved USB drive serial number, but block all other USB drives. Can you do this?
Endpoint DLP allows granular control over removable media. You can define specific USB devices by their Hardware ID or instance path and create exceptions to allow data transfer only to those corporate-approved devices.
Your organization uses Microsoft Defender for Cloud Apps. You want to identify if users are copying sensitive data to an unsanctioned cloud app. Which Purview feature integrates directly with this?
You can scope Microsoft Purview DLP policies directly to 'Microsoft Defender for Cloud Apps'. This allows you to apply DLP rules (like blocking or auditing) to files stored in connected third-party cloud apps (like Box or Google Drive).
What is the maximum number of fields (columns) you can define in an Exact Data Match (EDM) schema?
An Exact Data Match schema supports a maximum of 255 fields (columns) per datastore, allowing for highly complex databases, though only up to 5 fields can be marked as 'searchable'.
A user's risk level drops from 'High' to 'Low' in Adaptive Protection. What happens to the DLP policies applied to that user?
Adaptive Protection is fully dynamic. When the machine learning model determines the user's risk has subsided to 'Low', the stringent DLP controls are automatically lifted, minimizing admin overhead and user friction.
Which of the following actions is NOT supported by Teams DLP?
Teams DLP can block messages, replace them with a notification, show policy tips, and send incident reports. It cannot, however, delete an entire Teams channel or team.
You want to evaluate how an auto-labeling policy will affect your SharePoint environment before turning it on. You start a simulation. How do you view the results?
During an auto-labeling simulation, Purview processes the rules against existing data and surfaces the results directly in the Auto-labeling policy interface, showing you exactly which files would be labeled.
You want to configure Communication Compliance to detect when employees use Microsoft Teams to translate sensitive business data into other languages using unsanctioned bots. Can Communication Compliance detect multiple languages?
Communication Compliance natively supports multi-language detection. It can analyze and translate messages across over 100 languages to detect threatening language, harassment, or sensitive info.
What is the primary identifier used to track and correlate actions on a specific file across its lifecycle in Activity Explorer?
Activity Explorer relies heavily on the File Hash to track the journey of a document, even if the file name is changed or it is moved across different endpoints and cloud locations.
You need to prevent external users from accessing a highly sensitive SharePoint site. Can you achieve this with a Sensitivity Label?
Container-level sensitivity labels can be applied to SharePoint sites and M365 Groups to enforce strict external sharing policies, explicitly blocking guest access to the entire site.
A user leaves the company. You want to ensure their encrypted files can still be accessed by the IT department. What role is required to remove encryption from files owned by others?
The Azure Rights Management (RMS) 'Super User' feature allows designated administrators to decrypt any file protected by the tenant's sensitivity labels, ensuring data is not lost when employees leave.
What type of data does the 'Communication Compliance' tool NOT inspect by default?
Communication Compliance inspects corporate communications within the Microsoft 365 boundary (Teams, Exchange, Yammer). It cannot inspect personal third-party messaging apps on unmanaged devices.
You want to trigger an Insider Risk Management policy when a user's performance is downgraded. Which connector provides this data?
The HR Data Connector allows organizations to upload CSV files containing HR indicators, such as a user being placed on a Performance Improvement Plan (PIP), which acts as a triggering event for IRM policies.
Which tool provides recommendations and a secure score specifically for your data protection and compliance posture?
Microsoft Purview Compliance Manager provides a comprehensive compliance score. It evaluates your data protection configurations against regulatory frameworks (like GDPR, ISO 27001) and gives actionable recommendations.
You configure a DLP policy to protect U.S. Social Security Numbers. A user types 'My SSN is 123-45-6789'. Will this trigger a high-confidence match?
Microsoft's built-in SIT for U.S. SSNs looks for the 9-digit pattern. To achieve a high-confidence match, it also requires supporting keywords (like 'SSN' or 'Social Security') within a specific character proximity.
You configure a sensitivity label to expire access to a document after 30 days. When does the 30-day countdown begin?
When configuring a sensitivity label with an expiration date for access, the countdown begins on the exact date and time the label is applied to that specific file or email.
If Copilot uses data from a document labeled 'General' and a document labeled 'Confidential', what label will the final Copilot response inherit?
Copilot strictly follows the 'highest watermark' principle. If multiple sources are used, the generated response inherits the most restrictive (highest priority) sensitivity label among all the sources.
You are creating an Exact Data Match (EDM) sensitive information type. You need to map your fields to built-in SITs for validation. Which built-in SIT cannot be used for mapping?
In EDM, primary searchable fields must map to pattern-based SITs (built-in or custom regex) to validate the data format. Trainable Classifiers (which use AI/ML to read document context) cannot be used as field validators in an EDM schema.
Which configuration ensures that offline access to an encrypted document is revoked if a user is fired?
The 'Offline access' setting in a sensitivity label determines how many days a user can open the file without contacting the licensing server. Setting it to 0 ('Never') or a short duration ensures that once a user's Entra ID account is disabled, their cached offline access expires quickly.
You want to apply a sensitivity label to all existing emails in a specific user's Exchange Online mailbox. Which tool must you use?
Auto-labeling policies for data at rest can be scoped to Exchange Online mailboxes to crawl and apply labels to existing historical emails based on sensitive information types.
A user tries to copy an encrypted file to a USB drive. Endpoint DLP blocks the action. Does the file on the USB drive remain encrypted?
Because the Endpoint DLP policy is set to 'Block', the OS intercepts the copy operation before it executes. The file is never transferred to the USB drive.
In Insider Risk Management, you notice a user has a 'High' severity alert for 'Data leaks'. You investigate and determine it was a false positive (authorized work). What should you do?
If an IRM alert is determined to be benign or a false positive after investigation, the correct operational step is to 'Dismiss' the alert. This closes the alert and helps tune the ML model.
What is the maximum number of items (files/emails) that an auto-labeling policy can process per day in a tenant?
Microsoft Purview auto-labeling policies for data at rest can label up to 1,000,000 items (files and emails combined) per day per tenant.
You want to create a DLP policy that blocks the sharing of files containing the exact phrase 'Project Apollo'. Which matching method should you use?
For specific, static text phrases like project names, creating a custom Sensitive Information Type using a Keyword dictionary (or simple keyword list) is the most efficient and direct method.
You need to ensure that specific external guest users can read a labeled document, but cannot print it. Which feature in the Sensitivity Label configuration supports this?
When configuring encryption in a sensitivity label, you can explicitly add external domains or specific email addresses and assign them the 'Viewer' role, which allows reading but strips the 'Print' right.
Which dashboard in Microsoft Purview provides a holistic view of the overall health, active alerts, and configuration status of your DLP, IRM, and labeling deployments?
The Microsoft Purview Home portal (Overview page) acts as the central pane of glass, aggregating active alerts, policy matches, and the overall configuration health of your compliance and data security posture.
You are investigating a highly sensitive Microsoft 365 Copilot prompt that leaked internal data. Where are Copilot user prompts and responses natively stored for eDiscovery and retention purposes?
Microsoft 365 Copilot interactions (prompts and generated responses) are stored in a hidden folder within the individual user's Exchange Online mailbox, allowing them to be searched via eDiscovery and retained via Microsoft 365 Retention Policies.
You are configuring a sensitivity label using Double Key Encryption (DKE). Which of the following Microsoft 365 features will NOT function for documents protected by DKE?
Because Microsoft does not have access to the second encryption key, DKE-protected files cannot be decrypted by Microsoft 365 services. Therefore, features like Office on the Web viewing, co-authoring, eDiscovery, and search indexing are not supported.
You want to create a Data Loss Prevention (DLP) policy that operates silently in the background to log matches without notifying users or blocking emails. Which policy mode should you choose?
Running a DLP policy in Simulation mode (Test it out) evaluates the rules against data and logs the matches in the audit log and reports. It does not show policy tips to users or enforce blocking actions.
In Insider Risk Management, you can configure custom 'Indicator weightings'. What does this feature allow you to do?
Indicator weighting allows administrators to tune the machine learning model. By assigning a higher weight to certain actions (e.g., downloading from SharePoint), those specific actions will contribute more significantly to a user's overall risk score.
A container-level sensitivity label is applied to a Microsoft Teams site. Does this label automatically apply encryption to the individual files stored within that Team's SharePoint document library?
Container-level sensitivity labels dictate the governance of the container itself (the Team, Microsoft 365 Group, or SharePoint Site), such as guest access and device access. They do not automatically encrypt the files residing inside the container.
You are creating an Exact Data Match (EDM) sensitive information type. Which characters are automatically ignored by the EDM engine when hashing and matching data?
To ensure reliable matching even if the formatting differs slightly (e.g., '123-456' vs '123456'), the EDM engine normalizes data by automatically ignoring spaces and punctuation marks during both hashing and evaluation.
You need to integrate Insider Risk Management alerts with your organization's ServiceNow ticketing system. How can you natively automate this workflow from the Purview portal?
Microsoft Purview natively integrates with Power Automate. You can create a flow using the Insider Risk Management trigger 'When an alert is generated' to automatically create incidents in external ITSM tools like ServiceNow.
Which Endpoint DLP setting prevents a user from opening a sensitive file using an unauthorized application, such as a third-party PDF reader?
The 'Unallowed apps' setting in Endpoint DLP allows you to specify the executable names of applications that are prohibited from accessing, opening, or interacting with files that match your DLP policies.
You notice that the built-in 'Credit Card Number' Sensitive Information Type has a high false-positive rate in your tenant. What is the recommended way to resolve this without deleting the built-in SIT?
You cannot modify Microsoft's built-in SITs. To reduce false positives, the best practice is to copy the built-in SIT to create a custom one, add your organization-specific corroborating evidence, and use the custom SIT in policies.
What is the primary function of 'Document Fingerprinting' in Microsoft Purview?
Document Fingerprinting creates a hash of a standard form (like a blank NDA or tax form). It allows DLP to recognize when users share filled-out versions of that exact template, treating the form itself as a sensitive information type.
A user sends a message in a Microsoft Teams chat containing a credit card number. A DLP policy blocks the message. What does the recipient see?
When Teams DLP blocks a chat message, the original content is hidden. The sender sees a block icon and a policy tip, while the recipient sees a tombstone message stating that the message was blocked by organizational policy.
When configuring an auto-labeling policy for Exchange Online, you want to test the policy. How many emails must match the policy during simulation before you can officially turn the policy on?
To prevent misconfigurations, Microsoft Purview requires that an auto-labeling policy successfully completes a simulation and returns at least one match against existing data before the UI allows you to turn the policy 'On'.
You want to configure Microsoft Purview to automatically detect and protect source code (e.g., Python, C++) stored in OneDrive. Which classification method is best suited for this?
Microsoft provides a pre-trained Trainable Classifier specifically designed to recognize various programming languages and source code, which is far more accurate than trying to use regex or keywords for code syntax.
In the Purview AI Hub, you use the 'One-click' policy creation feature. What type of policy does this actually deploy?
The AI Hub's one-click policies rapidly deploy standard Data Loss Prevention (DLP) policies where the location is specifically scoped to 'Generative AI prompts', preventing sensitive data from being pasted into tools like Copilot.
An administrator wants to view the raw content of a file that triggered an Insider Risk Management alert. What role is required?
Within the Insider Risk Management workflow, the 'Insider Risk Management Investigator' role (or the broader IRM role) grants the ability to view the content of files associated with alerts via the Content Explorer integration inside the IRM case.
You are defining 'Network location groups' in Endpoint DLP. What are these groups used for?
Network location groups allow you to define your corporate network environment. You can then configure DLP rules to act differently based on the device's location (e.g., allow copying to a USB when on the corporate network, but block it when at home).
You create a custom Trainable Classifier. You upload 50 positive samples and begin training. The training fails. What is the most common reason for initial training failure?
Trainable Classifiers require strong, distinct semantic patterns. If the 50 positive seed documents are too dissimilar or don't share a cohesive theme, the machine learning model will fail to identify a reliable pattern and the training will abort.
A DLP policy evaluates an email containing a US Social Security Number. The policy has two rules: Rule A (Priority 0) blocks the email. Rule B (Priority 1) encrypts the email. What happens?
DLP rules are processed in priority order (0 is the highest). Once Rule A is triggered, its actions (Block) are applied, and rule processing for that specific policy stops. Rule B is ignored.
Which tool would you use to proactively discover if users are storing unencrypted credit card numbers in on-premises SMB file shares?
The Microsoft Purview Information Protection Scanner (formerly AIP Scanner) is specifically designed to crawl on-premises file repositories (SMB shares, NAS) to discover, classify, and label sensitive data.
You want to configure a sensitivity label to automatically apply a watermark to a document, but ONLY if the document contains a credit card number. How should this be done?
You can configure auto-labeling directly within the sensitivity label settings (for Office apps). If the client detects the Credit Card SIT, it automatically applies the label, which in turn stamps the watermark.
In the Microsoft Purview compliance portal, what is the 'Data classification overview' tab primarily used for?
The Data classification overview acts as a dashboard providing aggregated metrics, charts, and insights into where sensitive data lives and how sensitivity/retention labels are being utilized across the tenant.
A Communication Compliance policy is configured to detect 'Conflict of Interest'. How does Microsoft Purview detect this?
Communication Compliance relies heavily on Microsoft's pre-built Trainable Classifiers (AI models) to understand the context of conversations and detect complex scenarios like corporate sabotage, harassment, or conflicts of interest.
You want to implement Adaptive Protection. Which underlying Microsoft 365 capability must be configured and active for Adaptive Protection to function?
Adaptive Protection is directly powered by Insider Risk Management. IRM's machine learning engine calculates the user's risk level, which Adaptive Protection then feeds into DLP policies.
Which action is NOT available when configuring an auto-labeling policy for data at rest in SharePoint Online?
Auto-labeling policies are designed to respect user intent. They will apply a label to unlabeled content, but they cannot and will not overwrite or replace a sensitivity label that was manually applied by a user.
You configure a DLP rule for Exchange Online. You want the rule to trigger only if an email contains more than 10 unique credit card numbers. Which setting do you adjust in the condition?
The 'Instance count' setting in a DLP condition dictates how many times a sensitive information type must be found in the content before the rule is triggered. Setting it from 11 to 'Any' triggers on >10 instances.
A user is writing a document on a Windows 11 device that is disconnected from the internet. They attempt to copy an SSN to a USB drive. Will Endpoint DLP block this action?
Endpoint DLP syncs its policies to the local device. Because evaluation happens locally on the endpoint via the Defender agent, it can detect sensitive data and enforce block actions even when the device is completely offline.
You are investigating an Insider Risk Management alert. You want to hide the identities of users involved in the alerts to prevent bias. Where is user anonymization enabled?
User anonymization (showing pseudonyms instead of UPNs) is a global privacy setting within Insider Risk Management. It applies universally across all IRM policies and alerts in the tenant.
You need to update your Exact Data Match (EDM) datastore because your HR system generated 5,000 new employee IDs. How often can you upload new data using the EDM Upload Agent?
There is no strict temporal limit on uploading EDM data. Organizations typically automate the EDM Upload Agent via a Windows Scheduled Task to run daily or weekly to ensure the Purview datastore is synchronized with their internal databases.
Which Endpoint DLP setting would you use to prevent users from uploading an internal financial document to a webmail client like Gmail using Microsoft Edge?
Because Microsoft Edge is typically an allowed browser, you control where data can go by configuring 'Service domains' in Endpoint DLP, explicitly blocking sensitive file uploads to unauthorized domains like Gmail or Dropbox.
You configure a sensitivity label to 'Assign permissions now' and grant 'Reviewer' rights to a specific Entra ID security group. Later, you add a new user to that group. Does the new user get access to existing documents protected by that label?
When permissions are assigned to a group, the authorization is dynamic. Every time a user opens the file, they must authenticate against Azure RMS, which verifies their current group membership, ensuring new members get immediate access.
You want to configure Microsoft Purview Insider Risk Management to monitor executives more strictly. Which feature should you use?
Priority user groups in Insider Risk Management allow you to define groups of highly privileged or high-risk users (like executives or IT admins). Activities performed by these users are scored differently and generate alerts with higher severity.
What happens if a user tries to co-author an Excel workbook that is protected by Double Key Encryption (DKE)?
Double Key Encryption (DKE) ensures maximum privacy by preventing Microsoft from reading the data. Because Microsoft 365 services cannot decrypt the file, cloud-dependent features like co-authoring, autosave, and eDiscovery are completely unsupported.
A user wants to replace a 'Highly Confidential' label with a 'Public' label on a Word document. You want to require the user to provide a justification for this downgrade. Where is this configured?
The requirement to provide a justification when removing a label or replacing it with a lower-priority label is configured in the Sensitivity Label Publishing Policy, not within the individual label itself.
In Microsoft Teams, can a DLP policy block a user from sharing a sensitive file during a 1:1 chat?
Files shared in Teams 1:1 chats are actually stored in the sender's OneDrive. To protect files shared within Teams, the DLP policy must have the SharePoint and OneDrive locations enabled.
You want to dynamically apply a sensitivity label to a file when it is downloaded from Salesforce to an unmanaged device. Which Microsoft Purview integration makes this possible?
Microsoft Defender for Cloud Apps uses Conditional Access App Control to proxy sessions. You can create a Session Policy that inspects file downloads in real-time and applies a Purview sensitivity label before the file reaches the unmanaged device.
When Adaptive Protection elevates a user's risk level to 'High', how does the DLP system know which restrictions to apply?
Adaptive Protection integrates with standard DLP policies. Administrators create rules within their DLP policies where the condition is 'User's risk level for adaptive protection is', allowing different actions based on the dynamic risk score.
You are preparing an Exact Data Match (EDM) schema. Which character encoding must the source data file use before hashing?
When preparing the source data file (.csv or .tsv) for the Exact Data Match (EDM) Upload Agent, the file must be strictly saved using UTF-8 encoding. Other formats may cause parsing or hashing failures.
Which of the following is a limitation of using Microsoft's pre-trained Trainable Classifiers?
Pre-trained Trainable Classifiers (like Source Code, Resumes, IT Infrastructure) are built and maintained by Microsoft. They are ready to use out-of-the-box, but you cannot edit them or supply your own data to retrain them.
An Endpoint DLP policy restricts printing sensitive files. Which types of printers does this restriction apply to?
When Endpoint DLP restricts the 'Print' action, it intercepts the print spooler at the OS level, effectively blocking output to local, network, and virtual printers (such as Print to PDF or XPS).
You configure a default sensitivity label for a SharePoint Document Library. What happens to existing files that are already in the library?
Configuring a default sensitivity label for a SharePoint library only applies to newly uploaded, newly created, or subsequently modified files. Existing dormant files will not receive the label automatically.
In Insider Risk Management, what must you configure to ensure that 'Forensic Evidence' captures screen clips only for users involved in a severe incident?
Because screen capturing is highly privacy-sensitive, Forensic Evidence requires explicitly configuring a targeted policy defining the scope of users, and the capture only begins when a specific triggering event elevates their risk.
You want to configure an Incident Report in a DLP policy to trigger only when a severe violation occurs. Which setting allows you to trigger the report based on the volume of sensitive data leaked?
The 'Instance count' dictates the number of times a sensitive information type must appear in the document/email. Setting a high instance count (e.g., 50 to Any) ensures the rule and the incident report only trigger for massive data leaks.
How does the Microsoft Purview AI Hub discover the usage of generative AI apps across the organization?
Purview AI Hub aggregates data from Defender for Cloud Apps and Defender for Endpoint to build an inventory of generative AI applications being accessed by users, providing visibility into potential Shadow AI usage.
You are setting up a Communication Compliance policy to monitor a group of financial traders. In the policy terminology, what are these targeted users called?
In Communication Compliance, the individuals whose messages and emails are being monitored by the policy are officially referred to as 'Supervised users'.
You are defining a custom Sensitive Information Type (SIT) using a regular expression. To reduce false positives, you can apply a mathematical validation to the regex match. What is this called?
When creating custom SITs for formatted numbers (like ID cards or credit cards), you can add a Checksum function (such as the Luhn algorithm or Modulo 11) to mathematically validate that the matched string is a genuine number.
When using the EDM Upload Agent, why is a 'salt' value required?
The EDM agent uses a randomly generated salt string combined with the SHA-256 algorithm to hash your data locally. This salt ensures the resulting hashes are cryptographically secure and cannot be reverse-engineered.
You configure an auto-labeling policy for SharePoint Online. You want to skip the simulation phase. Can you turn the policy on directly?
To prevent accidental mass-labeling and encryption of thousands of files, Microsoft enforces a mandatory simulation phase for auto-labeling policies applied to data at rest. You cannot skip it.
In Endpoint DLP, you configure a network location group for your corporate VPN. You want to block USB copies only when users are NOT connected to the VPN. How do you configure this?
Endpoint DLP supports context-aware restrictions. You can set the primary action for Removable Media to 'Block', but configure an Exception in the rule that allows the action if the device's current 'Network location' matches your corporate VPN group.
A user types a credit card number into a Word document. A sensitivity label is automatically applied immediately as they type. Which capability handles this?
Client-side auto-labeling operates within the Office desktop and web applications. It evaluates content in real-time as the user edits the document and applies (or recommends) the label before the file is even saved.
During an Insider Risk Management investigation, you need to reveal the actual username of the employee (de-anonymization). Who can perform this action?
Users holding the Insider Risk Management or Insider Risk Management Investigator roles have the necessary permissions within the IRM case to temporarily turn off anonymization and reveal the actual user's identity.
A Communication Compliance policy detects a threatening message sent in Spanish. The compliance reviewer only speaks English. Does Microsoft Purview provide a native solution?
Communication Compliance includes a native, built-in translation feature powered by Azure AI. Reviewers can click to translate flagged messages from over 100 languages directly inside the review dashboard.
You apply a Sensitivity Label to a Microsoft 365 Group. You configure the label to deny 'External user access'. What happens?
Container-level sensitivity labels manage container settings. Denying external user access strictly prevents group owners from adding guest accounts to the Microsoft 365 Group, Team, or SharePoint site.
A user asks Microsoft 365 Copilot for a summary of a recent product launch, and Copilot retrieves information from a public competitor website to enrich the answer. Which feature allowed this?
Web grounding (or Web access) is the feature that allows Microsoft 365 Copilot to perform public web searches via Bing to supplement its responses. Administrators can restrict this to ensure Copilot only references internal tenant data.
You have Policy A (Priority 0) with Rule 1. You have Policy B (Priority 1) with Rule 2. If an email matches both policies, what actions are executed?
In Microsoft Purview DLP, policies are evaluated in priority order. If a match is found in a higher-priority policy (Policy A), its actions are applied, and the DLP engine stops evaluating any subsequent, lower-priority policies (Policy B).
In Activity Explorer, you want to see instances where users manually downgraded a sensitivity label. Which activity type should you filter by?
Activity Explorer classifies label changes meticulously. To specifically find instances where a label was replaced with a lower-priority label, you filter by the 'Label downgraded' activity type.
Endpoint DLP is deployed to macOS devices. Which of the following actions CANNOT currently be restricted by Endpoint DLP on macOS?
While macOS Endpoint DLP supports blocking USB transfers, network share transfers, and clipboard actions, fine-grained control over printing (especially virtual printing) is traditionally a Windows-specific capability in Endpoint DLP.
You uploaded a new dataset using the Exact Data Match (EDM) Upload Agent. How long does it typically take for the new data to be fully indexed and available for DLP matching in the cloud?
Once the EDM Upload Agent finishes uploading the hashed data, Microsoft Purview requires time to distribute and index this datastore globally across the tenant infrastructure. This process can take up to 24 hours.
A user applies an encrypted sensitivity label to a document. Later, they try to remove the label, but the option is grayed out. What is the most likely reason?
To remove or downgrade an encrypted sensitivity label, the user performing the action must have the 'Export' or 'Full Control' Azure RMS usage right on the document. Without it, the client prevents them from stripping the encryption.
A DLP policy blocks a user from sending an email, but allows overrides. The user clicks 'Override' and provides a business justification. Where does this justification appear?
When a user provides a business justification to override a DLP block, the text of that justification is logged in the Microsoft Purview Unified Audit Log and is included in any DLP Incident Reports generated by the alert.
You create a custom Trainable Classifier, provide the required seed data, and start the training. What is the typical timeframe for the initial machine learning training to complete?
The backend machine learning process for a custom Trainable Classifier takes time to analyze the semantic patterns in the provided seed data. The initial training phase typically takes up to 24 hours.
You deploy the Microsoft Purview Information Protection Scanner on a Windows Server. You want it to scan file shares and generate reports without actually applying labels or altering files. Which mode should you configure?
The AIP/Purview Information Protection Scanner can run in 'Discovery' mode. In this mode, it crawls the file shares, identifies sensitive data, and logs the findings to the Purview portal without applying labels or modifying the files.
In a Sensitive Information Type (SIT) configuration, what does 'Character Proximity' define?
Character proximity (e.g., 300 characters) dictates how close the supporting evidence (like the word 'Credit Card') must be to the primary match (the 16-digit number) for the system to consider it a valid, confident match.
You configure the 'Data theft by departing users' policy in Insider Risk Management. Besides the HR resignation date, what other signal can natively act as a trigger for this specific policy?
If an organization cannot integrate the HR data connector, they can trigger the 'Departing user' policy by manually adding the departing employee to a specific Microsoft Entra ID group tied to the IRM policy settings.
A user takes a photo of a whiteboard containing passwords and sends it in a Teams chat. Which Purview feature allows Communication Compliance to analyze the text inside the photo?
Optical Character Recognition (OCR) enables Microsoft Purview services, including Communication Compliance and DLP, to extract and evaluate text from image files (like photos, screenshots, and PDFs) shared in Teams or Exchange.
You configure an Endpoint DLP policy to 'Block' uploading sensitive files to cloud services via 'Unallowed browsers'. The user attempts the upload using Google Chrome (which is listed as unallowed). What occurs?
When an unallowed browser (like Chrome or Firefox, if not supported by the Purview extension) attempts to read a sensitive file for upload, the Defender agent intercepts the OS-level file access and blocks the action.
You want to prevent Copilot from summarizing documents that contain sensitive financial data. How should you approach this?
Copilot strictly honors sensitivity labels and encryption. If a document is encrypted and the user (or Copilot acting on behalf of the user) lacks the rights to view or extract the content, Copilot cannot read or summarize it.
You configure a Sensitivity Label Publishing Policy. Can you set a different default sensitivity label for Outlook emails compared to Word documents?
The Sensitivity Label Publishing Policy settings in the Purview UI explicitly allow administrators to define separate default labels: one specific to documents (Word, Excel, PowerPoint) and one specific to emails (Outlook).
You are creating a DLP policy for SharePoint Online. You want the policy to trigger based on a specific SharePoint metadata column (e.g., Department = 'Finance'). Which condition must you use?
The 'Document properties is' condition in a DLP rule evaluates the custom metadata properties or columns assigned to a file in SharePoint Online or OneDrive.
An Insider Risk Management investigator escalates a severe case to an 'Advanced eDiscovery' case. What happens to the forensic evidence and alerts associated with the IRM case?
Escalating an IRM case seamlessly integrates with eDiscovery Premium. The system automatically creates a new eDiscovery case and copies the relevant user data, alerts, and forensic evidence into it for legal holds and legal review.
Adaptive Protection evaluates user risk. Which of the following is NOT a native integration where Adaptive Protection can automatically apply restrictive policies?
Adaptive Protection specifically feeds user risk levels into Purview Data Loss Prevention (DLP) policies across Exchange, Endpoint, Teams, and SharePoint. It does not natively alter identity-based policies like Entra ID Conditional Access.
Within Insider Risk Management, which role is designed to review alerts and triage them, but CANNOT escalate an alert to a formal investigation case?
The 'Insider Risk Management Analyst' role allows users to triage initial alerts to determine if they are benign. However, if an alert requires escalation to a full case, an Investigator or Admin must perform that action.
When automating the Exact Data Match (EDM) Upload Agent via a scheduled task, what is the recommended method to authenticate the agent securely?
For automated, unattended uploads of EDM hashes, Microsoft recommends configuring an Entra ID Service Principal (App Registration) and assigning it the necessary permissions, authenticating via a certificate or client secret.
You are deploying Endpoint DLP. A user opens a newly downloaded file, and Endpoint DLP hasn't finished scanning it yet. You want to prevent the user from copying the file to a USB drive until the scan completes. Which feature handles this?
Just-In-Time (JIT) Protection in Endpoint DLP blocks egress activities (like copying to USB or network shares) on newly created or modified files until the DLP engine fully evaluates the content for sensitive information.
Can the Microsoft Purview Information Protection Scanner be configured to scan and label data stored directly inside an on-premises SQL Server database?
The Microsoft Purview Information Protection Scanner (formerly AIP Scanner) is strictly designed to discover and label files stored on SMB network shares and on-premises SharePoint Server. It does not scan structured databases like SQL.
In Communication Compliance, an end-user receives a harassing message in Microsoft Teams. How can this message be brought to the attention of compliance reviewers without an automated policy catching it?
Microsoft Teams includes a native user-driven reporting feature. Users can click the ellipses (...) on a message and select 'Report a message', which routes the message directly to the Communication Compliance dashboard for review.
You configure a DLP rule with 'Incident reports' enabled. You set the option to 'Send an alert when the volume of matched items reaches a threshold'. What does this achieve?
Threshold-based incident reporting aggregates alerts. Instead of sending an email for every single matched file, it waits until the user violates the policy a specified number of times within a time window before generating the alert.
A user pastes sensitive data from a Word document into an unauthorized third-party application on a Windows endpoint. You want to block this action but allow pasting into Notepad. How do you configure Endpoint DLP?
In Endpoint DLP, if you restrict the 'Copy to clipboard' action, you can define exceptions by adding specific executable names (like notepad.exe) to the 'Allowed apps' list, ensuring business continuity for approved tools.
Which exact feature within Exact Data Match (EDM) limits the maximum number of fields that the engine actively searches documents for to prevent performance degradation?
While an EDM datastore can have up to 255 columns (fields), Microsoft Purview restricts the schema to a maximum of 5 'searchable' fields to maintain high scanning performance across the tenant.
What happens to the default sensitivity label applied to a SharePoint Document Library if a user uploads a file that already has a higher-priority manual label applied?
Microsoft Purview always respects user intent. If a file is uploaded to a library with a default label, the system checks for existing labels. A manually applied label will never be overwritten by a default or auto-labeling policy.
To monitor Copilot interactions, you decide to use Microsoft Purview eDiscovery. What exactly are you searching for when querying Copilot activity?
Copilot interactions (prompts and responses) are saved in the user's Exchange mailbox as a specific message class. eDiscovery searches can specifically target these interactions by querying the 'IPM.SkypeTeams.Message.Copilot' item class.
In Insider Risk Management, an investigator disables the anonymization feature to view the real names of users involved in an alert. Is this action audited?
To maintain strict privacy oversight (who watches the watchers), any action to disable user anonymization within Insider Risk Management is logged in the Purview Unified Audit Log.
You are creating a DLP policy for Exchange Online. You want to exclude emails from being scanned if the email subject contains the phrase '[SECURE]'. Which DLP policy option do you configure?
DLP rules allow you to configure 'Exceptions'. By adding an exception where the 'Subject contains words or phrases' equals '[SECURE]', the DLP engine will bypass the block actions for those specific emails.
A user tries to share an encrypted sensitivity-labeled document with an external guest via a SharePoint link. The label is configured to 'Assign permissions now' restricting access only to internal tenant users. What happens?
SharePoint might still allow the generation of a sharing link, but the ultimate authority is the Azure Rights Management Service. When the external guest opens the file, they must authenticate. Since they are not authorized in the label's permissions, RMS denies decryption.
You are implementing Microsoft Purview AI Hub. Which prerequisite must be met to view 'Generative AI activity' metrics from user endpoint devices?
The AI Hub relies on telemetry gathered from endpoints to track which generative AI applications (like external ChatGPT) are being accessed. This requires the devices to be actively onboarded to Microsoft Defender for Endpoint.
A user takes a screenshot of a sensitive email on their macOS device. Can Endpoint DLP restrict this action?
While Endpoint DLP can restrict clipboard actions and screen captures on Windows endpoints, restricting screen captures on macOS is not natively supported by the Microsoft Purview Endpoint DLP agent due to OS architectural limitations.
In an auto-labeling policy for Exchange, you can specify rules to run 'when content matches'. Which of the following is a valid condition for Exchange auto-labeling?
Auto-labeling policies for Exchange transit allow conditions based on mail flow, such as whether the email is being sent to a recipient outside the organization, ensuring labels are applied before external egress.
What is the primary benefit of using 'Trainable Classifiers' over 'Keyword Dictionaries' in Microsoft Purview?
While keyword dictionaries only look for explicit word matches, Trainable Classifiers use machine learning to analyze the structure, context, and semantics of the document, making them ideal for categorizing unstructured data types like agreements, source code, or resumes.
Which Purview tool is used to define and manage boundaries that prevent specific groups of users (e.g., Day Traders and Investment Bankers) from communicating or sharing files with each other?
Information Barriers (IB) are policies in Microsoft 365 used to restrict communication and collaboration between two specific internal groups to prevent conflicts of interest (e.g., restricting Teams chats and SharePoint sharing between specific departments).
You want to create a DLP policy that blocks sharing of credit card numbers in SharePoint, but only if the sharing link is configured for 'Anyone with the link'. Which DLP condition is used?
The 'Content is shared from Microsoft 365' condition allows you to specify whether the DLP rule applies when a file is shared with people outside the organization, allowing you to intercept external guest links and 'Anyone' links.
You are creating a new Exact Data Match (EDM) SIT. Which PowerShell cmdlet is used to upload the hashed data using the EDM Upload Agent?
The EDM Upload Agent is a standalone command-line executable (`EdmUploadAgent.exe`), not a standard PowerShell cmdlet. You run it using flags like `/UploadData` and `/DataStoreName` to initiate the hashing and upload process.
Which of the following is true regarding Microsoft 365 Copilot and Data Loss Prevention (DLP)?
Microsoft Purview allows administrators to scope DLP policies to the 'Generative AI prompts' location. This evaluates user interactions with Copilot and can block prompts containing sensitive information types (like SSNs or credit cards).
A user downloads an encrypted file from SharePoint. They send it as an email attachment to a personal email address. Will the file remain encrypted when it arrives in the personal inbox?
Sensitivity label encryption is persistent. The encryption is embedded within the file itself. Even if the file leaves the corporate boundary, the recipient must still authenticate against the Azure RMS service to open it.
In Adaptive Protection, what is the default expiration time for a user's elevated risk level if they perform no further risky activities?
By default, Adaptive Protection risk levels are dynamic. If a user is elevated to a High or Moderate risk level, that elevated state persists for 7 days. If no further risky behavior is detected, the user's risk level decays back to the baseline.
Which capability allows you to define different sensitivity label policies based on whether a user is an employee or a contractor?
Publishing policies dictate which users see which labels. You can create one publishing policy scoped to the 'Employees' Entra ID group with specific default labels, and another scoped to 'Contractors' with more restrictive labels.
An Insider Risk Management policy generates a 'High' severity alert. You notice that the alert includes activity from a personal webmail site. Which integration provided this telemetry?
Insider Risk Management aggregates signals. When a user accesses personal webmail and uploads files via a browser, that endpoint-level telemetry is provided by the Microsoft Defender for Endpoint agent running on their local machine.
You want to block the use of the 'Print Screen' key on keyboards for documents containing the 'Confidential' sensitivity label. How is this achieved?
Removing the 'Copy and extract content' right in a sensitivity label natively triggers the OS/application to black out or block screenshots (including the Print Screen key) when the document is active. Endpoint DLP can also enforce screen capture blocks globally based on content.
What is the primary difference between a Retention Label and a Sensitivity Label?
Sensitivity labels are focused on Information Protection (access control, encryption, DLP). Retention labels are focused on Data Lifecycle Management (keeping data for compliance or securely deleting it after a period).
You configure a DLP policy with the location set to 'Devices'. You want the policy to apply ONLY to Windows devices and ignore macOS. How is this configured?
When configuring actions in Endpoint DLP rules, Microsoft separates them into 'Audit or restrict activities on Windows devices' and 'Audit or restrict activities on macOS devices'. You simply configure actions only for the Windows section.
Which Purview feature is required to detect if an employee is consistently downloading excessive amounts of data from SharePoint over a 30-day period, comparing their behavior to their peers?
Insider Risk Management utilizes machine learning to establish behavioral baselines for users and their peers. It can detect cumulative exfiltration anomalies, such as downloading small amounts of data daily that add up to a massive volume over time.
To configure Communication Compliance, your organization's legal team requires that reviewers are explicitly prohibited from seeing the names of the users being monitored. Is this possible?
Like Insider Risk Management, Communication Compliance includes privacy settings that allow administrators to turn on pseudonymization, which obscures user identities (displaying randomized names) to prevent bias during investigations.
In the context of Copilot, what is 'Just-in-Time (JIT) access' via Entra ID used for?
Organizations practicing least-privilege can use Entra ID PIM to grant Just-in-Time access to specific SharePoint sites. Copilot will only be able to query and summarize data from those sites while the user's temporary access window is active.
A user is assigned the 'Compliance Administrator' role. Can this user view the raw text of a credit card number in Content Explorer?
The 'Compliance Administrator' role allows viewing dashboards and configuring policies, but it explicitly denies access to read raw sensitive content. The 'Data Classification Content Viewer' role is strictly required to read file contents.
A DLP rule uses the Exact Data Match (EDM) condition. How is the EDM rule configured in the DLP policy builder?
Once an EDM datastore and schema are created, Microsoft Purview generates a Sensitive Information Type (SIT) for it. You simply add it to a DLP policy exactly like any standard SIT using the 'Content contains' condition.
You want to evaluate how your DLP policies are performing without impacting users, but you still want the users to see warning messages (Policy Tips) to educate them. Which DLP mode achieves this?
Simulation mode allows the policy to log matches without enforcing block actions. However, you can explicitly check a box to 'Show policy tips' during simulation, which educates users without actually blocking their workflows.
In an auto-labeling policy for data at rest (SharePoint), how many locations (sites) can you target per policy?
Microsoft Purview allows an auto-labeling policy for data at rest to target up to 10,000 SharePoint sites or 10,000 OneDrive accounts per policy.
Which Purview tool would you use to find out which user downgraded a sensitivity label from 'Confidential' to 'Public' on a specific Word document yesterday?
Activity Explorer provides a granular, historical view of all label-related activities. You can filter by 'Label downgraded' and search for the specific file name or user to pinpoint the exact event.
You are creating a new sensitivity label. You want to ensure that files protected by this label can NEVER be accessed offline. What setting do you choose?
In the encryption settings of a sensitivity label, the 'Allow offline access' setting dictates how many days the local cache is valid. Setting this to 'Never' forces the client to authenticate with Azure RMS every single time the file is opened.
An Insider Risk Management policy triggers a 'Data leak' alert. The user copied 100 files to an external hard drive. Which feature allows you to visually map this user's risk sequence and related activities over time?
Inside an IRM alert, the User Activity Profile provides an interactive timeline and bubble chart. It visually maps out the sequence of anomalous activities (like downloading, copying, and deleting) to help investigators quickly understand the context.
When creating a Communication Compliance policy, you select the built-in 'Threat' classifier. Does this classifier analyze attachments sent in Exchange emails?
Communication Compliance natively extracts and analyzes text from supported attachments (including Office documents and PDFs) attached to Exchange emails and Teams messages.
You configure Endpoint DLP to monitor unallowed browsers. If a user renames 'chrome.exe' to 'winword.exe' to bypass the block and uploads a file, what happens?
Microsoft Defender and Endpoint DLP use advanced inspection (including publisher details, digital signatures, and hashes) to identify applications. Renaming the executable will not bypass the unallowed browser or unallowed app restrictions.
You want to deploy Microsoft Purview AI Hub to govern Copilot usage. Do you need to install a specific agent on user laptops?
The AI Hub does not require a new standalone agent. It leverages the existing telemetry from Microsoft 365 cloud services, Defender for Cloud Apps, and the Microsoft Defender for Endpoint sensor already built into Windows.
You have a sensitivity label configured to apply a watermark. A user applies this label to an Excel workbook. Where does the watermark appear?
Unlike Word or PowerPoint where watermarks appear across the document body, in Excel, watermarks are technically inserted as text in the header/footer and are only visible in Page Layout view or when printed.
Which capability allows you to define a specific subset of employees (e.g., 'Research and Development') and apply stricter Insider Risk Management scoring exclusively to them?
Priority User Groups allow you to target specific high-risk or highly privileged subsets of users. When applied to an IRM policy, the model adjusts its scoring threshold to be more sensitive to activities performed by these specific users.
You want to apply a sensitivity label to all Microsoft Teams meetings organized by the 'Finance' department. Where do you configure this?
To ensure all new calendar events and Teams meetings created by specific users receive a label automatically, you configure the 'Default label for meetings and calendar events' setting within the Sensitivity Label Publishing Policy scoped to those users.
In Exact Data Match (EDM), you configure the primary field as 'Social Security Number'. If a document contains the SSN but does NOT contain any of the corroborating fields (like First Name or Last Name), what happens?
To reduce false positives, the Exact Data Match engine requires both the primary field (the search criteria) AND at least one piece of corroborating evidence (a secondary mapped field) to be found in close proximity to trigger a match.
A user in your tenant attempts to share a file labeled 'Highly Confidential' with a guest user in Microsoft Teams. The sensitivity label is configured to deny 'External user access'. What is the result?
If a container or file label actively denies external sharing, Microsoft 365 natively enforces this at the application layer. The Teams/SharePoint UI will block the action, informing the user that sharing with external guests is prohibited by policy.
A user is assigned to a 'Departing Users' Insider Risk Management policy because their HR resignation date was imported. How long does the policy actively monitor them after their resignation date?
IRM Departing User policies establish an activation window. Typically, the machine learning model evaluates anomalous behavior historically (e.g., 30 days prior to the event) and monitors actively for a set period (e.g., 30 days after) to catch data exfiltration.
You configure a DLP policy with the action to 'Block everyone' when a file contains sensitive data. Can a Global Administrator open the blocked file in SharePoint?
DLP block actions in SharePoint/OneDrive are strict. By default, access is restricted to everyone except the file owner, the person who last modified the file, and the site collection administrator. A Global Admin cannot open it unless they grant themselves Site Admin rights.
Which tool would you use to define a custom Regex pattern to detect your company's proprietary 12-digit project codes?
Creating a Custom Sensitive Information Type (SIT) allows you to define specific Regular Expressions (Regex), assign keyword corroborating evidence, and define character proximity to accurately detect proprietary organizational patterns.
In Endpoint DLP, you want to block users from pasting sensitive data into unauthorized applications, but you want to allow them to paste it into Microsoft Word. Where do you configure Microsoft Word?
When restricting clipboard pasting or app access via Endpoint DLP, you must explicitly define approved applications (like winword.exe) in the 'Allowed apps' section of the Endpoint DLP settings to permit data flow.
You've reviewed all 255 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free