Microsoft Updated SC-401 Exam Questions and Answers by yousif

Microsoft Endpoint DLP relies on Microsoft Defender for Endpoint (MDE) for its enforcement.

Onboarding Windows 10/11 devices to Defender for Endpoint ensures the Endpoint DLP policies can be applied, including monitoring and protecting content across apps and browsers.

User1 can delete File1 on March 10, 2023.

No - File1 has Retention1 applied, which retains it for 4 years with a "Retain only" action. This means it cannot be deleted during the retention period, which ends on March 1, 2027.

User2 can delete File1 on March 10, 2027.

No - User2 is a Member and does not have the Owner role, which is required to delete files under retention policies during the retention period. Additionally, the "Retain only" action prevents deletion until the retention period ends on March 1, 2027.

User2 can edit File2 on March 15, 2025.

No - File2 has Retention2 applied, which retains it for 2 years with a "Retain and delete" action. This means the file is protected from edits or deletions during the retention period, which ends on March 1, 2025. Since March 15, 2025, is after the retention period, the file would be eligible for deletion, but the question specifies editing, which is restricted during the retention period.

A. Create a DLP policy → Needed to detect sensitive information being shared externally.

B. Turn on Indicators → Required for insider risk policies to detect risky activities like external sharing.

C. Configure adaptive protection → Optional for tailoring enforcement, not mandatory here.

D. Turn on analytics → Helps assess policy impact but not required to generate alerts.

E. Create an insider risk policy → Required to generate insider risk alerts.

Step 1 – Scenario

The requirement is to ensure Microsoft Purview Insider Risk Management can collect signals when a user copies files to a USB device using their default browser. The devices differ by browser type:

Device1 → Default browser = Microsoft Edge

Device2 → Default browser = Google Chrome

Step 2 – Signal collection methods in Insider Risk Management

Insider Risk Management uses Microsoft Purview Information Protection client and Purview browser extensions to collect activity signals.

For Microsoft Edge (Chromium-based), insider risk signals are collected via the Microsoft Purview Information Protection client.

For Google Chrome, signals are collected through the Microsoft Purview extension (available in the Chrome Web Store).

The Microsoft Defender Browser Protection extension is for web protection against malicious sites, not for insider risk activity signals, so it is irrelevant here.

Step 3 – Microsoft Reference

Microsoft documentation:

“For insider risk signals collection in Microsoft Edge, the Microsoft Purview client must be deployed. For Google Chrome, the Microsoft Purview extension is required.”