Microsoft Certified: Information Security Administrator Associate — Practice Set 1

Question 1

You are configuring Microsoft Purview sensitivity labels for your organization. You need to ensure that documents labeled as Confidential are automatically encrypted when sent outside the organization. Which sensitivity label setting should you configure?

Accepted Answer

Sensitivity label encryption settings allow you to configure permissions that are enforced when the document or email leaves the organization. You can define which users or domains are allowed access and what rights they have. Content marking adds visual indicators but does not protect content. Auto-labeling automatically applies labels but does not configure encryption behavior. Container settings apply to Teams and SharePoint sites, not individual documents.

Question 2

Your organization needs to detect credit card numbers and national identification numbers in documents stored in SharePoint Online and OneDrive. The detection must use pattern matching and must be customizable to reduce false positives. Which Microsoft Purview feature should you implement?

Accepted Answer

Built-in sensitive information types (SITs) in Microsoft Purview use regular expression pattern matching combined with keyword proximity and checksum validation to detect data like credit card numbers and national IDs. They are customizable through confidence levels and supporting element adjustments to reduce false positives. Trainable classifiers use machine learning for document type classification, not pattern-based data detection. Custom sensitivity labels classify and protect content but are not detection mechanisms. Compliance Manager tracks compliance, not content detection.

Question 3

You need to create a custom sensitive information type (SIT) for your organization's proprietary employee ID format, which follows the pattern EMP-XXXXXXXX (3 letters, dash, 8 digits). You need to ensure the detection is accurate. Which Microsoft Purview capability should you use to define this pattern?

Accepted Answer

A custom sensitive information type with a regular expression pattern is the correct approach for a structured, predictable format like EMP-XXXXXXXX. The regex would precisely match the format. Trainable classifiers use ML and are better for unstructured content classification, not precise format matching. Keyword dictionaries match exact words, not patterns. EDM is for exact matching against a database of known values, not format-based pattern detection.

Question 4

Your organization has a database containing patient records with exact social security numbers, dates of birth, and names. You need to detect exact instances of this data in email and documents to prevent data leakage, rather than detecting patterns. Which Microsoft Purview sensitive information type capability should you use?

Accepted Answer

Exact data match (EDM) sensitive information types allow you to match against exact values from a specific dataset (your patient database), providing high-precision detection that eliminates false positives by only triggering on actual records in your data. Built-in SITs detect patterns (e.g., any SSN-formatted number), not exact database records. Trainable classifiers identify document categories, not specific records. Document fingerprinting detects forms based on a template structure, not specific record values.

Question 5

You need to deploy the Microsoft Purview Information Protection client to end-user Windows workstations so users can manually apply sensitivity labels to files in Windows Explorer and Office applications. Which component provides this capability?

Accepted Answer

The Microsoft Purview Information Protection client (formerly Azure Information Protection unified labeling client) is installed on Windows workstations and provides sensitivity labeling capabilities in Windows Explorer for non-Office files, Office add-in enhancements, and a viewer for protected files. The compliance portal is a web admin interface. Defender for Endpoint is an EDR solution. The AIP scanner is a server-side component for bulk scanning on-premises repositories, not user workstations.

Question 6

You are configuring sensitivity label auto-labeling policies in Microsoft Purview. You need to automatically label and encrypt financial reports that contain credit card numbers as they are stored in SharePoint Online. Which two components must be configured for this to work? Choose 2.

Accepted Answer

Auto-labeling requires both a sensitivity label configured with encryption (which will be applied to matching files) and an auto-labeling policy that defines the conditions (credit card number SIT) and scope (SharePoint Online) for the label to be automatically applied. A DLP policy blocks sharing but does not apply labels. Trainable classifiers identify document categories, not required for pattern-based SIT auto-labeling. Defender for Cloud Apps file policies can apply labels via a separate mechanism but are not required for Purview auto-labeling.

Question 7

Your organization uses Microsoft Exchange Online and needs to encrypt emails sent to external recipients that contain sensitive financial information. Recipients using non-Microsoft email clients must be able to read the message through a web portal without installing any software. Which Microsoft Purview feature should you configure?

Accepted Answer

Microsoft Purview Message Encryption (formerly Office 365 Message Encryption) encrypts emails and allows external recipients to read protected messages through a web portal without requiring special software or certificates. S/MIME requires recipients to have S/MIME certificates and supporting email clients. Transport Rules with TLS enforce encrypted transmission but do not protect message content at rest or for end-user access control. Advanced Message Encryption adds custom branding and revocation capabilities on top of base Message Encryption.

Question 8

You are deploying the Microsoft Purview Information Protection scanner to classify and label files stored on on-premises Windows file servers. The scanner has been installed and registered. What must you configure in the Microsoft Purview compliance portal before the scanner can begin discovering and classifying files?

Accepted Answer

After installing and registering the scanner, you must create a content scan job in the Microsoft Purview compliance portal (Information Protection > Scanner > Content scan jobs) that specifies the network repository paths, the sensitive information types and labels to scan for, and the scanning behavior. Content search is a Microsoft Purview eDiscovery feature for cloud data. DLP for on-premises covers endpoint DLP actions on Windows, not server scanning. Auto-labeling policies apply to cloud services, not on-premises file servers via the scanner.

Question 9

You need to monitor how sensitivity labels are being used across your organization and identify content with specific labels in SharePoint Online and Exchange Online. Which Microsoft Purview tool provides a searchable view of labeled and classified content with filters for label name, location, and file type?

Accepted Answer

Content explorer in the Microsoft Purview compliance portal allows administrators to browse and search actual content items that have been classified (with sensitivity labels or sensitive information types), showing the files themselves with filters for label, location, and file type. Activity explorer shows label-related user activities (changes, downloads) but not the actual content items. Data catalog is a Microsoft Purview data governance feature for data assets. Compliance Manager tracks regulatory compliance, not content classification.

Question 10

Your organization needs to prevent users from sending emails containing credit card numbers to external recipients. You want to display a policy tip to users explaining the violation before the email is blocked. Which Microsoft Purview solution should you configure?

Accepted Answer

A Microsoft Purview DLP policy configured with a credit card number sensitive information type, an external recipient condition, a block action, and a user notification policy tip both informs users of the violation and prevents the email from being sent. Sensitivity labels encrypt but do not block sending. Exchange transport rules can redirect or block but do not provide user-friendly policy tips explaining the DLP rationale. Defender for Cloud Apps session policies monitor cloud app access, not Exchange email composition.

Question 11

You are configuring Microsoft Purview Endpoint DLP. Users frequently copy sensitive files to USB drives, which violates company policy. You need to block copying of files labeled Confidential to USB drives on Windows endpoints. Which configuration enables this?

Accepted Answer

Microsoft Purview Endpoint DLP supports activities on Windows endpoints including copy to removable USB storage. A DLP policy with an endpoint rule targeting files with the Confidential sensitivity label and a block action for the copy to removable storage activity prevents the transfer. Intune disabling all USB ports is a blunt control that also blocks legitimate USB use (keyboards, mice). Sensitivity label policies manage label behavior, not device activity. Defender for Endpoint ASR rules block malicious software behaviors, not specific data movement by sensitivity label.

Question 12

Your organization has multiple DLP policies with overlapping conditions. An email matches both a high-priority financial data policy and a lower-priority general data policy. The financial policy blocks the email, while the general policy allows it with a policy tip only. What is the effective outcome for this email?

Accepted Answer

In Microsoft Purview DLP, when multiple policies match, the policy with the highest priority (lowest number) takes precedence. Once the highest-priority matching policy's rules are evaluated and a block action is triggered, that action is applied. The most restrictive matching rule within the highest-priority policy determines the outcome. The more permissive lower-priority policy's actions are not applied when a higher-priority policy already matches and takes action.

Question 13

You are implementing Adaptive Protection in Microsoft Purview for your organization. A user is identified as a high insider risk level by Microsoft Purview Insider Risk Management. You need the DLP policy to automatically apply more restrictive actions for this user without creating separate policies for each risk level. What is the correct approach?

Accepted Answer

Adaptive Protection in Microsoft Purview automatically adjusts DLP policy enforcement based on a user's current insider risk level (elevated, minor, moderate, or custom) from Insider Risk Management. You configure DLP rules with Adaptive Protection conditions so that more restrictive actions apply to higher risk users dynamically, without requiring separate policies. This is more efficient and responsive than manually creating separate policies per risk level. Conditional Access blocks application access but does not provide data-level DLP actions. Sensitivity label policies do not dynamically adjust based on risk levels.

Question 14

You are designing a Microsoft Purview retention policy for your organization's Microsoft Teams chat messages. The legal team requires that all Teams chat messages be retained for 7 years and that users cannot delete them before the retention period expires. Which two settings must be configured in the retention policy? Choose 2.

Accepted Answer

To retain Teams chat messages for 7 years and prevent user deletion, you must set the retention duration to 7 years with a Retain action (which preserves content even if users delete it, by keeping copies in the Preservation Hold Library) and apply the policy to the Teams user chats and channel messages locations. The 'Retain' action inherently preserves content regardless of user deletion — a separate 'prevent deletion' toggle is not a separate required setting in the policy UI. Sensitivity labels are used for classification/protection, not applying retention policies to Teams locations.

Question 15

A user accidentally deleted emails containing important contracts. The emails were subject to a Microsoft Purview retention policy set to retain for 5 years. How can an administrator recover these emails?

Accepted Answer

When a retention policy with a Retain action is in place, deleted emails are moved to the Recoverable Items folder (specifically the Preservation Hold Library) and cannot be permanently deleted by the user during the retention period. An administrator can use eDiscovery or Content search to locate and recover these emails from the Recoverable Items folder. Restoring the entire mailbox from backup is disruptive and unnecessary. Content search can find items in Recoverable Items but is used to find items; recovery is done through the Recoverable Items mechanism.

Question 16

You need to apply a 3-year retention label automatically to all documents in a specific SharePoint Online library that contain the keyword 'contract'. You want the label to be applied without user intervention. Which Microsoft Purview retention feature should you configure?

Accepted Answer

An auto-apply retention label policy using a keyword query (KQL) automatically applies the specified retention label to content matching the keyword 'contract' in the scoped SharePoint library without requiring user action. Manually published labels require users to apply them. A retention policy applies to all content in the site without granularity for specific keywords. Sensitivity labels do not have retention sub-labels; retention and sensitivity are separate label types.

Question 17

You are reviewing a content item that has both a retention policy and a retention label applied. The retention policy retains items for 3 years, and the retention label retains for 7 years and then deletes. The item is 2 years old. What is the effective retention behavior?

Accepted Answer

In Microsoft Purview, a retention label takes precedence over a retention policy when both apply to the same item. This is because retention labels are considered more specific (item-level) than retention policies (container-level). The principle of specificity ensures that the more specific, manually or automatically applied label wins. The item will be retained for 7 years and then deleted according to the label's action.

Question 18

You are configuring Microsoft Purview Insider Risk Management for your organization. You need to detect when employees who have been placed on a performance improvement plan start copying large amounts of data to USB drives or personal cloud storage. Which Insider Risk Management policy template is most appropriate?

Accepted Answer

The 'Data theft by departing users' template is designed to detect risky data exfiltration activities by users who are being monitored due to planned departure or other HR triggers. Employees on a performance improvement plan are at elevated risk of departure and match this template's intended use case when combined with an HR connector that flags PIP status. 'General data leaks' does not use HR triggers. 'Data leaks by priority users' focuses on high-value users, not users at departure risk. 'Security policy violations' focuses on security software and configuration, not data movement.

Question 19

Your organization has Microsoft Purview Insider Risk Management deployed. A user has been generating high-risk alerts related to mass file downloads and sending files to personal email. The security team needs to review exactly what the user was viewing on screen during the flagged activities. Which Insider Risk Management feature allows this review?

Accepted Answer

Microsoft Purview Insider Risk Management forensic evidence captures screen activity captures for users who are in scope for forensic evidence collection, allowing investigators to view exactly what was on screen during flagged risky activities. Activity explorer shows label and DLP activities, not screen captures. Defender for Endpoint device timeline shows security events, not screen captures. Microsoft Purview Audit log records administrative and user activities in Microsoft 365 services but not screen captures.

Question 20

You need to configure Microsoft Purview Audit to retain audit logs for 2 years for specific user activities related to sensitive document access. Your organization has Microsoft 365 E5 licenses. Which configuration achieves this?

Accepted Answer

Microsoft Purview Audit (Premium), available with E5 licensing, allows you to create custom audit retention policies that specify the workload, activities, user scope, and retention period up to 10 years. The default E5 retention is 1 year for most records, not 2 years automatically. Exporting to Azure Storage is a workaround, not the intended Audit (Premium) approach. Audit (Standard) only retains logs for 90 days, and Log Analytics workspace retention is not an Audit (Premium) feature.

Question 21

You are implementing Data Security Posture Management (DSPM) for AI in your organization. Your organization uses Microsoft 365 Copilot and you need to identify where sensitive data may be overshared with Copilot. Which prerequisite must be configured for DSPM for AI to assess AI-related data risks?

Accepted Answer

DSPM for AI in Microsoft Purview assesses data exposure risks by analyzing content accessed by AI services. For it to identify sensitive content exposure, sensitivity labels (or at minimum sensitive information type classifications) must be deployed and applied to data, so the DSPM for AI policies can identify labeled sensitive content that is accessible to Copilot. Without labeling, DSPM for AI cannot determine which data is sensitive. Defender for Cloud, Conditional Access, and Intune enrollment are not prerequisites for DSPM for AI data posture assessment.

Question 22

You need to respond to a Microsoft Purview DLP alert that indicates an employee shared a file containing credit card numbers to a personal OneDrive account. Which two actions can you take directly from the Microsoft Purview portal to investigate and respond to this alert? Choose 2.

Accepted Answer

From the Microsoft Purview portal, you can review DLP alert details including the matched content and activity, and you can confirm or dismiss the alert and add notes as part of alert triage workflow. Disabling Microsoft Entra ID accounts, wiping devices, and resetting passwords are not actions available in the Purview portal — these are performed in Microsoft Entra ID and Microsoft Intune respectively.

Question 23

You are an information security administrator investigating a potential data exfiltration incident. You need to search for all emails sent by a specific user over the past 30 days that contained files with a specific sensitivity label, across Exchange Online and SharePoint Online. Which Microsoft Purview tool should you use?

Accepted Answer

Microsoft Purview Content search allows you to search across Exchange Online mailboxes and SharePoint Online sites using keyword queries and conditions including date ranges, senders, and sensitivity labels. It can identify emails and documents matching the investigation criteria and export the results for review. Activity explorer shows classification activity events but is not designed for cross-service content investigation. Defender XDR Advanced Hunting queries telemetry but not SharePoint content directly. Data explorer shows classified content items but is not an investigation search tool for specific user activity.

Question 24

Your organization has deployed Microsoft Purview Insider Risk Management with Adaptive Protection enabled. You need to verify which users are currently at elevated risk and what risk level they have been assigned. Where in the Microsoft Purview compliance portal can you find this information?

Accepted Answer

The Adaptive Protection section within Microsoft Purview Insider Risk Management contains a 'User risk levels' view that shows current user risk level assignments (elevated, moderate, minor) and the policies driving those assignments. The Alerts dashboard shows open alerts but not the dynamic risk level assignments used by Adaptive Protection. The DLP Adaptive Protection conditions show the policy configuration, not current user risk states. Audit logs record activities but do not provide the Adaptive Protection risk level view.

Question 25

You need to implement controls in Microsoft Purview to protect content that is processed by Microsoft 365 Copilot. You need to prevent Copilot from summarizing documents labeled as Highly Confidential and sharing the summary with users who do not have access to the original document. Which control achieves this?

Accepted Answer

Microsoft 365 Copilot respects sensitivity label permissions: if a document is encrypted with a Highly Confidential label that restricts access to specific users, Copilot will not be able to read or summarize the content for users who do not have permissions to the encrypted document. The encryption enforced by the label is the control that prevents unauthorized summarization and sharing. Blocking Copilot for all users or disabling it entirely removes the productivity benefit without targeted protection. DLP policies can control data movement but are not designed to restrict Copilot's ability to read encrypted content — encryption itself is the primary control.

SC-401 — Information Security Administrator Associate