Free Microsoft SC-401 Practice Exam with Questions & Answers | Set: 3

Step 1 – Understand the scenario

We have a Microsoft 365 E5 subscription with Copilot available.

File1.docx has a sensitivity label applied.

The sensitivity label controls usage rights (Owner, Editor, Restricted Editor, Viewer).

The question: Which users can summarize File1 with Microsoft 365 Copilot?

Step 2 – Sensitivity labels and usage rights

When a sensitivity label is configured to apply encryption with usage rights, each role has different levels of access:

Owner: Full control (read, edit, reshare, extract, etc.).

Editor: Can read, edit, and copy content.

Restricted Editor: Can read and edit in place, but cannot copy, print, or extract content.

Viewer: Can only read (view) the content.

???? Reference: Rights included in usage rights for sensitivity labels

Step 3 – Copilot’s requirements for summarization

Microsoft 365 Copilot requires that the user has the ability to read and extract text from the document in order to generate a summary.

Owners and Editors: ✅ Can both read and extract → Copilot works.

Restricted Editors: ❌ Cannot copy/extract text → Copilot cannot summarize.

Viewers: ❌ Can only view → Copilot cannot process content for summarization.

???? Reference: Microsoft 365 Copilot and sensitivity labels

“Users must have extract and copy rights in order for Microsoft 365 Copilot to process and summarize labeled documents.”

Step 4 – Apply to the case

User1 (Owner) → Can summarize.

User2 (Editor) → Can summarize.

User3 (Restricted Editor) → Cannot summarize.

User4 (Viewer) → Cannot summarize.

Step 1 – Understand the feature

The scenario is about Microsoft Purview Data Security Posture Management for AI (DSPM for AI), a capability in Microsoft Purview that helps:

Discover sensitive data across AI environments (including Copilot for Microsoft 365).

Assess data exposure risks.

Apply policies for data classification and protection.

When you deploy DSPM for AI, Microsoft Purview automatically creates default policies to classify and protect sensitive content.

Step 2 – Which solutions are used to edit these policies?

DSPM for AI (D) → This is the core solution where the default DSPM policies are deployed and visible. To edit or manage them, you must use the DSPM for AI blade in Microsoft Purview.

Information Protection (B) → DSPM relies on Microsoft Information Protection (MIP), specifically sensitivity labels and sensitive information types. These labels and SITs are part of Purview Information Protection. Editing classification rules (e.g., sensitivity labels, sensitive info types, trainable classifiers) requires Information Protection.

???? Reference:

Microsoft Purview Data Security Posture Management for AI (DSPM for AI)

Overview of sensitivity labels in Microsoft Purview Information Protection

Step 3 – Why not the others?

A. Insider Risk Management → Detects risky insider activities (data theft, sabotage). Not used to configure DSPM policies.

C. Compliance Manager → Provides compliance score and assessments, but does not configure DSPM policies.

E. Information Barriers → Used to restrict communication between groups of users. Not related to DSPM.

F. Data Lifecycle Management → Manages retention and deletion of data. Not related to DSPM for AI policy editing.

G. Data Loss Prevention (DLP) → Protects sensitive data from being shared in apps/services, but DSPM’s default policies are not edited here.

Understanding DLP Policy Impact on File Access

The DLP policy (DLPpolicy1) applies to Site2 and restricts access when:

● Content contains SWIFT Codes.

● Instance count is 2 or more.

File Analysis (Based on SWIFT Codes Count)

Files that remain accessible (not restricted by DLP):

● File1.docx (Contains only 1 SWIFT Code → Below restriction threshold)

User access after DLP policy is applied:

User1 (Site Owner):

● Has higher privileges and can override DLP restrictions (through admin intervention).

● Can access 2 files (File1.docx + override access to another file).

User2 (Site Visitor):

● Has read-only access but DLP blocks access to restricted files.

● Can only access 1 file (File1.docx), since all others are restricted.

To meet the requirement that all administrative users must be able to create Microsoft 365 sensitivity labels, we need to assign the Sensitivity Label Administrator role to the correct users.

Sensitivity Label Administrator Role Responsibilities

This role allows users to:

● Create and manage sensitivity labels in Microsoft Purview.

● Publish and configure auto-labeling policies.

● Modify label encryption and content marking settings.

Review of Admin Roles from the Table:

Users that must be assigned the Sensitivity Label Administrator role:

● Admin2 (Compliance Data Administrator)

● Admin3 (Compliance Administrator)

● Admin1 (Global Reader) (should be assigned this role to fulfill the requirement that all admins can create labels).

The goal is to automatically label documents in Site1 that contain credit card numbers. To achieve this, we need a sensitivity label with an auto-labeling policy based on a sensitive info type that detects credit card numbers.

Step 1: Create a Sensitive Info Type

● A sensitive info type is needed to detect credit card numbers in documents.

● Microsoft Purview includes built-in sensitive info types for credit card numbers, but we can also create a custom one if necessary.

Step 2: Create a Sensitivity Label

● A sensitivity label is required to classify and protect documents containing sensitive information.

● This label can apply encryption, watermarking, or access controls to credit card data.

Step 3: Create an Auto-Labeling Policy

● An auto-labeling policy ensures that the sensitivity label is applied automatically when credit card numbers are detected in Site1.

● This policy is configured to scan files and automatically apply the correct sensitivity label.

The requirement states that all Microsoft 365 data for users must be retained for at least one year. In Microsoft 365, retention policies must be configured for each type of data storage.

Step 1: Identifying Where Data is Stored

From the case study, users store data in the following locations:

● SharePoint Online sites

● OneDrive accounts

● Exchange email

● Exchange public folders

● Teams chats

● Teams channel messages

Since these locations fall under two broad categories:

● Microsoft Exchange data (Emails, Public folders)

● SharePoint, OneDrive, and Teams data

Step 2: Required Retention Policies

1️. A single retention policy can cover:

● SharePoint Online

● OneDrive

● Microsoft Teams

2. A second retention policy is required for:

● Exchange (Emails & Public Folders)

Thus, the minimum number of retention policies required to meet the requirement is 2.

Microsoft 365 retention policies can be applied broadly across multiple services with just two policies:

● One for Exchange & Public Folders

● One for SharePoint, OneDrive, and Teams

There's no need for separate policies for each individual workload unless different retention durations are required, which is not stated in the requirement.

Understanding Site4's Retention Policies:

● Site4RetentionPolicy1 deletes items older than 2 years from creation. If a file was created on January 1, 2021, it would be deleted after January 1, 2023.

● Site4RetentionPolicy2 retains files for 4 years from creation. If a file was created on January 1, 2021, it will be kept until January 1, 2025, but not deleted after that (policy states "Do nothing").

Statement 1 - Yes, because Site4RetentionPolicy2 ensures files are retained for 4 years.

Statement 2 - Yes, because Site4RetentionPolicy2 retains the file for 4 years (until January 1, 2025).

Statement 3 - No, because retention is only for 4 years (until January 1, 2025). After that, the policy does "nothing," meaning the file is no longer recoverable after that period.

To detect and protect confidential documents, we need a custom rule to identify project codes that start with 999 (since they are classified as confidential).

Box 1: A Sensitive Info Type (SIT) allows Microsoft Purview DLP policies to recognize structured data (e.g., project codes). DLP policies require a sensitive info type to detect content based on patterns, keywords, or dictionary terms. A sensitivity label alone does not define detection logic—it is used for classification and protection after content is identified.

Box 2: Since project codes follow a structured 10-digit pattern, we should use a Regular Expression (Regex) to match project codes that start with 999.

Example Regex pattern:

999\d{7}

This pattern detects a 10-digit number starting with "999".

EDM does not store raw data; instead, it requires hashed versions of sensitive data for privacy and security. To upload the hashed data, Microsoft provides the EDM upload agent. This ensures that the data is securely processed and recognized by the EDM service in Microsoft 365.

The content search uses the KQL editor with the query -Author:USER1. In eDiscovery/Content search, the minus sign denotes NOT and KQL is case-insensitive for property values. Therefore, this query returns items whose Author is not ‘User1’.

File1.docx → Author = User1 → excluded

File2.docx → Author = User2 → included

File3.docx → Author = USER1 (same as User1, case-insensitive) → excluded

Result: File2.docx only.