SC-400 Practice Questions

Microsoft Defender for Cloud Apps integrates with Microsoft Purview Information Protection. To control real-time user activities like file uploads to specific cloud apps, you must configure a session policy. This policy can be configured to perform content inspection, leveraging data classification services like the 'Project Phoenix' trainable classifier. When a match is found, the policy can apply a control, such as blocking the upload. A file policy scans files at rest, not in-transit uploads. An app governance policy is for OAuth app behaviors, and a standard DLP policy in Purview without Defender for Cloud Apps integration cannot control unsanctioned third-party apps.

DLP policies for Exchange Online are configured at the service level. When you enable policy tips in a DLP policy, the setting applies to all supported Outlook clients that can render them, including modern versions of Outlook for Windows, Outlook for Mac, and Outlook on the web. No separate configuration is needed to enable the same policy tip in Outlook on the web if it's already configured for the Exchange location.

Event-based retention is designed for scenarios where the retention period starts from an event that occurs outside of the content's properties (like creation or modification date). In this case, the 'TrialCompleted' date is the external event. An administrator would create an event type, apply a retention label configured to start retention based on that event to all trial documents, and then create an event instance with the specific completion date for each trial. This starts the 15-year clock for all associated documents on the correct date. Static policies or creation-date-based labels would not meet the requirement of starting retention from a variable completion date.

The Policy lookup tool is specifically designed to troubleshoot retention policy conflicts. It allows an administrator to specify a site, mailbox, or user and see all retention policies and labels that apply. Most importantly, it simulates the principles of retention to show which policy (the one with the longest retention period, or the explicit inclusion) would 'win' for a given location, helping to diagnose why content might have been deleted or retained unexpectedly. Content Explorer shows what data is classified, Activity Explorer shows user activities, and Audit Log shows actions taken, but only Policy lookup explains the 'why' behind policy application.

Audit (Premium) features, including high-value events like MailItemsAccessed and user search activities, are not enabled by default with standard auditing. The primary prerequisite for these advanced audit events to be logged is that the users being audited must have the appropriate license, which is typically a Microsoft 365 E5 license or a specific Microsoft 365 E3 with a compliance add-on that includes Audit (Premium). Without the correct license assigned, these premium events will not be generated or captured in the audit log.

This is the most precise and scalable solution. By creating a 'Removable storage device group' for the authorized devices, you can create specific DLP rules that reference this group. This allows you to build a policy that explicitly permits copying of sensitive data ONLY to this approved group, while a more general rule can block copying to all other USB devices. Simply allowing hardware IDs in the global settings doesn't integrate with the sensitivity label context, and a simple block rule doesn't allow for the required exception for company-issued devices.

A retention label is required to define the retention settings, such as the 10-year period and the disposition action. Critically, it must be configured to start the retention period based on an event rather than the content creation or modification date.

Event-based retention requires an event type to be defined (e.g., 'Case Closed'). When a case is closed, an instance of this event is created (often via a script or Power Automate) with asset IDs (like the email message IDs or mailbox), which triggers the 10-year retention countdown defined in the associated retention label.

Insider Risk Management relies heavily on signals from the Microsoft 365 audit log to detect user activities. Without auditing enabled for SharePoint file activities (like FileDownloaded), the policy will not receive the necessary signals to detect the high-volume downloads, rendering the policy ineffective regardless of other configurations like the HR connector or policy template.

The most direct and simplest way to apply a default retention label to all new content in a specific document library is to configure it directly in that library's settings. This ensures any new document uploaded or created in that location automatically inherits the 'Engineering-Blueprints' label. An auto-apply policy is more complex and typically used for applying labels based on content or metadata across multiple locations.

A Preservation Lock is designed to make a retention policy immutable to meet strict regulatory requirements (like SEC Rule 17a-4). Once a lock is applied, it cannot be disabled or made less restrictive by anyone, including a Global Administrator or Microsoft Support. This is a fundamental principle of the feature.