Microsoft Microsoft Certifications SC-400 Questions & Answers

• Question 301:

  DRAG DROP

  You have a Microsoft 365 E5 subscription.

  You need to create the Microsoft Purview insider risk management policies shown in the following table.

  

  Which policy template should you use for each policy? To answer, drag the appropriate policy templates to the correct policies. Each template may be used once, more than once, or not at all. You may need to drag the split bar between

  panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Data theft by departing users

  Policy1: Monitors the printing of files by users that submitted their resignation.

  Data theft by departing users

  When users leave your organization, there are specific risk indicators typically associated with potential data theft by departing users. This policy template uses exfiltration indicators for risk scoring and focuses on detection and alerts in this

  risk area. Data theft for departing users might include downloading files from SharePoint Online, *printing files*, and copying data to personal cloud messaging and storage services near their employment resignation and end dates.

  Note: Insider risk management analysts and investigators may use cumulative exfiltration detection insights to help identify exfiltration activities that may not typically generate alerts but are above what is typical for their organization. Some

  examples may be departing users slowly exfiltrate data across a range of days, or when users repeatedly share data across multiple channels more than usual for data sharing for your organization, or compared to their peer groups.

  Incorrect:

  * Security policy violations by departing users

  Box 2: Data leaks by priority users

  Policy2: Monitors the accidental sharing of data outside of an organization by users in a priority user group.

  Data leaks by priority users (preview)

  Protecting data and preventing data leaks for users in your organization might depend on their position, level of access to sensitive information, or risk history. Data leaks can include accidental *oversharing* of highly sensitive information

  outside your organization or data theft with malicious intent. With an assigned data loss prevention (DLP) policy as a triggering event option, this template starts scoring real-time detections of suspicious activity and result in an increased

  likelihood of insider risk alerts and alerts with higher severity levels. Priority users are defined in priority user groups configured in the insider risk management settings area.

  Box 3: Data Leaks

  Policy3: Monitors the downloading of files from Microsoft SharePoint Online to personal cloud storage services

  Data leaks

  Protecting data and preventing data leaks is a constant challenge for most organizations, particularly with the rapid growth of new data created by users, devices, and services. Users are empowered to create, store, and share information

  across services and devices that make managing data leaks increasingly more complex and difficult. Data leaks can include accidental oversharing of information outside your organization or data theft with malicious intent. With an assigned

  Microsoft Purview Data Loss Prevention (DLP) policy, built-in, or customizable triggering events, this template starts scoring real-time detections of suspicious *SharePoint Online data downloads*, file and folder sharing, printing files, and

  copying data to personal cloud messaging and storage services.

  Reference:

  https://learn.microsoft.com/en-us/purview/insider-risk-management-policy-templates

  https://learn.microsoft.com/en-us/purview/insider-risk-management-policies

• Question 302:

  DRAG DROP

  You have a Microsoft 365 E5 subscription.

  You need to configure Microsoft Priva Privacy Risk Management polices to generate alerts for the following scenarios:

  1.

  Scenario1: Personal customer data is stored in files located on publicly accessible Microsoft SharePoint Online sites

  2.

  Scenario2: Personal customer data is discussed in a Microsoft Teams chat.

  3.

  Scenario3: Personal customer data is emailed outside of an organization.

  Which policy template should you use for each scenario? To answer, drag the appropriate policy templates to the correct scenarios. Each template may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Data overexposure Scenario: Personal customer data is stored in files located on publicly accessible Microsoft SharePoint Online sites

  Data overexposure policies in Privacy Risk Management Your organization may store content at various levels of access, including areas that are publicly accessible and others that are restricted. Data overexposure policies can help you detect and handle situations in which data stored by your organization is insufficiently secure. For example, if access to an internal site is open to too many people or your permissions settings have not been maintained, personal data stored on that site may be vulnerable to a breach. Data overexposure policies can evaluate your data for these risks and alert you to potential issues.

  When a policy match is detected, you can send users email notifications that include remediation options to resolve issues. For data overexposure, these include making content items private, notifying content owners, or tagging items for further review.

  Box 2: Data transfer

  Scenario2: Personal customer data is discussed in a Microsoft Teams chat.

  Default data transfer policy settings

  A data transfer policy created from the template will detect:

  *-> (Box 2) Teams. Example: sending a Teams chat message containing personal data to a recipient who's outside of your organization.

  *-> (Box 3 When personal data within your organization is transferred to or shared with a recipient or location outside of your organization.

  When personal data is shared externally from any of these locations within your organization:

  Exchange. Example: sending an email containing personal data to a recipient email address that's outside of your organization.

  OneDrive and SharePoint. Examples: sending a link to a file or site that contains personal data to someone outside of your organization; copying or moving a file to a OneDrive or SharePoint location that sits outside of your organization.

  Box 3: Data transfer

  Scenario3: Personal customer data is emailed outside of an organization.

  Note: Data transfer policies in Privacy Risk Management

  Transferring personal data presents risks, especially when transferred outside of your organization, or sent between certain departments or geographic locations within your organization. For example, if the data is sent via unencrypted emails

  or to unauthorized recipients, the data may no longer be secure. Data transfer activities like these can have regulatory impact or may violate established organizational privacy practices.

  Data transfer policies in Privacy Risk Management allow you to monitor for personal data transfers outside of your organization, as well as internal transfers between different departments or countries or regions. When a policy match is

  detected, you can send users email notifications that allow them to take corrective action right in the email, such as making content items private, notifying content owners, or tagging items for further review.

  Incorrect:

  * Data minimization Data minimization policies in Privacy Risk Management Data minimization policies focus on the age of your content and how long it has been since it was last modified. Monitoring for personal data that's still being retained in older, unused content can help you better manage your stored data and reduce risks.

  Privacy Risk Management allows you to create policies to monitor data that hasn't been modified within a timeframe that you select. When a policy match is detected, you can send users email notifications with remediation options include marking items for deletion, notifying content owners, or tagging items for further review.

  Reference: https://learn.microsoft.com/en-us/privacy/priva/risk-management-policy-data-overexposure https://learn.microsoft.com/en-us/privacy/priva/risk-management-policy-data-minimization https://learn.microsoft.com/en-us/privacy/priva/risk-management-policy-data-transfer

• Question 303:

  DRAG DROP

  You have a Microsoft 365 subscription that contains 20 data loss prevention (DLP) policies.

  You need to identify the following:

  1.

  Rules that are applied without triggering a policy alert

  2.

  The top 10 files that have matched DLP policies

  3.

  Alerts that are miscategorized

  Which report should you use for each requirement? To answer, drag the appropriate reports to the correct requirements. Each report may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/view-the-dlp-reports

• Question 304:

  DRAG DROP

  You have a Microsoft 365 E5 subscription.

  You need to prevent the sharing of sensitive information in Microsoft Teams.

  Which entities can you protect by applying a data loss prevention (DLP) policy to each resource? To answer, drag the appropriate activities to the correct entity. Each activity may be used once, more than once, or not at all. You may need to

  drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://learn.microsoft.com/en-us/purview/dlp-microsoft-teams

• Question 305:

  DRAG DROP

  You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps.

  You plan to deploy a Defender for Cloud Apps file policy that will be triggered when the following conditions are met:

  1.

  A file is shared externally.

  2.

  A file is labeled as internal only.

  Which filter should you use for each condition? To answer, drag the appropriate filters to the correct conditions. Each filter may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view

  content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Access level

  A file is shared externally.

  File filters

  Defender for Cloud Apps can monitor any file type based on more than 20 metadata filters (for example, access level, file type).

  Below is a list of the file filters that can be applied. To provide you with a powerful tool for policy creation, most filters support multiple values and a NOT.

  * Access level – Sharing access level; public, external, internal, or private.

  Internal - Any files within the Internal domains you set in General setup.

  -> External - Any files saved in locations that aren't within the internal domains you set.

  Shared - Files that have a sharing level above private.

  Box 2: Sensitive label

  A file is labeled as internal only.

  Reference: https://learn.microsoft.com/en-us/defender-cloud-apps/file-filters

• Question 306:

  DRAG DROP

  You have a Microsoft 365 E5 subscription.

  You need to label Microsoft Exchange Online emails that match the following conditions:

  1.

  Contain employment offers

  2.

  Contain offensive language

  3.

  Contain medical terms and conditions

  The solution must minimize administrative effort.

  Which type of data classification should you use for each condition? To answer, drag the appropriate data classification types to the correct conditions. Each data classification type may be used once, more than once, or not at all. You may

  need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://learn.microsoft.com/en-us/purview/classifier-learn-about https://learn.microsoft.com/en-us/purview/classifier-tc-definitions https://learn.microsoft.com/en-us/purview/sit-learn-about-exact-data-match-based-sits

• Question 307:

  DRAG DROP

  You have a Microsoft 365 E5 subscription and use Microsoft Purview.

  The subscription contains the following users:

  1.

  User1: Must be able to investigate policy matches, but unable to view the file content related to the match.

  2.

  User2: Must be able to investigate policy matches and view the file content related to the match.

  3.

  User3: Must be able to create, update, and delete Microsoft Priva Privacy Risk Management policies.

  You need to add each user to a role group. The solution must follow the principle of least privilege.

  To which role group should you add each user? To answer, drag the appropriate role groups to the correct users. Each group may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to

  view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 308:

  DRAG DROP

  You need to recommend a solution that meets the sales requirements.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. (Choose three.)

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide

• Question 309:

  DRAG DROP

  You need to meet the technical requirements for the Site1 documents.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide#how-to-configure-auto-labeling-policies-for-sharepoint-onedrive-and-exchange