Question 1

You are configuring client-side auto-labeling for a sensitivity label. You want to use an Exact Data Match (EDM) sensitive information type as the only detection condition. After saving the label configuration, no auto-labeling fires on documents that clearly match the EDM SIT. What is the most likely cause?

Accepted Answer

Correct answer: C. EDM-based custom SITs can be used in label auto-labeling conditions, but Purview silently turns off the auto-labeling setting if an EDM SIT is configured as the only condition with no accompanying non-EDM SIT. A built-in SIT (such as Credit Card Number) must also be included in the label's auto-labeling conditions alongside the EDM SIT.

Question 2

A sensitivity label policy is configured with a default label of 'General' and mandatory labeling is also enabled. A licensed user creates a new Word document. Which behavior correctly describes what happens in supported Office versions?

Accepted Answer

Correct answer: D. When a default label is configured alongside mandatory labeling, the default label takes priority over the mandatory labeling prompt in supported Office versions. The default is applied automatically, satisfying the mandatory requirement, so the user never sees the mandatory labeling dialog. Mandatory labeling without a default generates a prompt; with a default, it is silently satisfied.

Question 3

You are reviewing sensitivity label configurations with a new compliance analyst. They state: 'Once we apply the Confidential label to a file, the label protects the file from being opened by unauthorized users.' Which clarification is most accurate?

Accepted Answer

Correct answer: B. A sensitivity label is metadata: it identifies and classifies content. Only if the label is configured with encryption does it actually restrict who can open the file. Encryption is the only label action that genuinely controls access; headers, footers, watermarks, and the label stamp itself are marking and signaling tools, not access controls.

Question 4

You are configuring a service-side auto-labeling policy to apply an encrypting label to documents in SharePoint. The label's encryption is configured with dynamically assigned permissions and a 30-day access expiry. When you try to include this label in the auto-labeling policy, you find it cannot be selected for SharePoint and OneDrive locations. What is the reason?

Accepted Answer

Correct answer: D. Service-side auto-labeling in SharePoint and OneDrive has specific encryption requirements. The label's encryption must use 'Assign permissions now' and user access must not expire (set to Never). Dynamically assigned permissions (Let users assign permissions) and expiring access are not supported for SPO and OneDrive auto-labeling. Exchange-only policies are more flexible on this requirement.

Question 5

A user applies a sensitivity label to a .txt file using the Microsoft Purview Information Protection client on Windows. The label is configured with encryption. After applying the label, the user reports the .txt file now has a .ptxt extension and will only open in a viewer application, not in Notepad. What is the correct explanation?

Accepted Answer

Correct answer: B. When the Information Protection client encrypts standalone file types like .txt with native encryption, the file extension changes: .txt becomes .ptxt, .png becomes .ppng, and so on. These files must be opened in the Information Protection viewer rather than their native applications. This is documented behavior and is operationally relevant: firewalls, proxies, and DLP tools that key on file extensions can break when they encounter these renamed files.

Question 6

You are evaluating whether to enable co-authoring for files encrypted with sensitivity labels in your tenant. Before flipping this setting, which of the following consequences must you evaluate and plan for?

Accepted Answer

Correct answer: B. Enabling co-authoring for files with sensitivity labels changes the labeling metadata format and its storage location in Word, Excel, and PowerPoint files. Any app, script, or tool in the tenant that reads labeling metadata from the old location will misread it after the change: it may see labeled files as unlabeled or display stale label names. This is effectively a one-way change: disabling it is PowerShell-only and can lose new-format labeling metadata for unencrypted files.

Question 7

You are designing a label taxonomy for a first deployment. Microsoft recommends a specific maximum number of top-level labels beyond which user effectiveness drops noticeably. What is that recommended maximum?

Accepted Answer

Correct answer: C. Microsoft's own taxonomy guidance states that effectiveness drops noticeably past five top-level labels and five sublabels per top-level label. The technical ceiling is much higher (1,000+ labels in a tenant), but the practical ceiling that preserves user accuracy is five top-level labels. Microsoft's published recommendation is no more than five top-level parent labels, each with five sublabels, for 25 total. Treat 25 as the recommended maximum wall, not the target.

Question 8

Your tenant has two label priority orders that interact: file-scoped labels (Personal=0, Public=1, General=2, Confidential=3, Highly Confidential=4) and a container-scoped label (Confidential Sites=5). A user uploads a document labeled Highly Confidential (priority 4) to a SharePoint site labeled with Confidential Sites (priority 5). What happens?

Accepted Answer

Correct answer: C. The 'Detected document sensitivity mismatch' event fires when a document with a higher-priority label is uploaded to a site with a lower-priority label, not the other way around. If the document label is HIGHER priority than the container label, SharePoint is concerned the sensitive document may be in a less-protected container. In this scenario, the container label has priority 5 and the document has priority 4, meaning the container's priority is higher than the document's. No mismatch event fires because the document is in a more-sensitive-or-equal container.

Question 9

You have two label policies assigned to the same user. Policy A (order 0, lowest priority) has mandatory labeling ON and a default label of General. Policy B (order 1, highest priority) has mandatory labeling OFF and a default label of Confidential. The user creates a new document. What is the effective behavior?

Accepted Answer

Correct answer: C. When a user is in scope of multiple label policies, they receive the union of all labels from all their policies. For setting conflicts, the policy with the highest order number (highest priority) wins for each individual setting. Policy B has the highest order number, so its settings (mandatory labeling OFF, default label Confidential) take precedence over Policy A's settings.

Question 10

You configure a service-side auto-labeling policy for SharePoint and OneDrive in simulation mode. After the simulation completes, the admin does not act on the results. What happens to the policy if left untouched?

Accepted Answer

Correct answer: C. If a simulated auto-labeling policy is left untouched after simulation, it can auto-enable itself after a set number of days following the last edit (commonly 7 days; default auto-labeling policies for new customers have a different initial window of 25 days before simulation starts, then 7 after editing). Admins who plan to simulate and decide later may find the policy has turned itself on. The safe approach is to choose 'Leave policy turned off' explicitly if not ready to enforce.

Question 11

An Endpoint DLP policy is configured to Block the 'Copy to clipboard' activity for files matching a Confidential SIT. A user copies text from a protected Word document. The Block fires. The user waits 30 seconds without clicking Allow. What happens next?

Accepted Answer

Correct answer: B. Block with override behaves differently by activity type, and that split is the trap here. Print, Copy to USB, and Copy to network share give the user a 30-second window to click Allow after the popup; clipboard is not on that list. For clipboard, the user must click Allow and then redo the copy action, and nothing auto-proceeds on a timeout.

Question 12

You configure Adaptive Protection and an associated DLP policy. A user who is currently at Elevated insider risk level is attempting to share a Confidential-labeled document externally. The DLP policy is set to block sharing of Confidential-labeled documents when the Insider risk level for Adaptive Protection is Elevated. The policy has been enabled for 24 hours. The block is not firing. What is the most likely cause?

Accepted Answer

Correct answer: D. After enabling Adaptive Protection, it can take up to 36 hours before risk levels begin applying and actions take effect. The full quick-setup pipeline can take up to 72 hours. A policy enabled for only 24 hours may not have fully activated. The recommendation is to tune the underlying IRM policy before enabling Adaptive Protection and to account for the 36-72 hour window before expecting blocks to fire.

Question 13

An administrator turns on a new DLP policy with 'Turn it on right away' and immediately sends a test email containing a credit card number. The policy shows no match after five minutes. What is the most likely explanation?

Accepted Answer

Correct answer: B. Microsoft Learn states explicitly: 'In general, policies take effect about an hour after being turned on.' The DLP policy reference also says you can run the policy 'as soon as an hour after it's created' by selecting Turn it on right away. Testing within the first few minutes means the policy has not yet propagated across the service.

Question 14

Your endpoint DLP rollout covers Windows 10/11 devices. Users browse in Microsoft Edge, Google Chrome, and Mozilla Firefox. You need endpoint DLP to monitor and block sensitive uploads to restricted cloud-service domains across all three browsers. What must you deploy, and what is the platform constraint?

Accepted Answer

Correct answer: D. Edge is instrumented for endpoint DLP natively and needs no add-on. To extend endpoint DLP activity monitoring and protective actions (upload to a restricted service domain, print, copy to clipboard / removable storage / network share) to Chrome and Firefox, you install the Microsoft Purview extension for Chrome and the Microsoft Purview extension for Firefox respectively. Per Learn, these extensions are for Windows 10/11 devices. Where the extension is installed, it bypasses the unallowed-browser and unallowed-app restrictions for that browser, so monitoring works instead of a hard block.

Question 15

Your organization uses Microsoft Purview DLP. You want to block files shared externally from SharePoint that contain sensitive data, but allow internal users to continue accessing them. Which action should you choose?

Accepted Answer

Correct answer: B. The SharePoint/OneDrive 'Restrict access or encrypt content in Microsoft 365' action has sub-options. 'Block only people outside the organization' preserves internal user access while preventing external sharing, exactly matching the requirement. 'Block everyone' removes access for all including internal users and owners.

Question 16

An administrator configures a Microsoft Defender for Cloud Apps (MDCA) file policy that targets Box and removes external collaborators from files containing sensitive information. The policy fires as expected on a file owned by an internal user. The same policy is later tested against a file stored in the same Box environment but owned by an external partner who shared it inward. The policy produces no match. What explains the behavior?

Accepted Answer

Correct answer: A. This reflects a documented MDCA/SaaS connector limitation: externally-owned files in Box, Google Drive, and Dropbox are treated as the external party's private data and are not exposed to the organization's MDCA tenant via API. Unlike OneDrive (which re-assigns an internal owner to externally-dropped files), Box and Dropbox do not expose external-owner files. This is a provider API constraint, not a configuration issue.

Question 17

Two DLP policies are enforced on an endpoint device. Policy ABC: blocks Print and audits all other activities. Policy MNO: blocks Copy-to-USB and audits all other activities. A file matching both policies is opened on the device. A user tries to print the file and simultaneously copy it to a USB drive. What does Endpoint DLP enforce?

Accepted Answer

Correct answer: A. Microsoft Learn confirms: 'Endpoint DLP applies the aggregate or sum of most restrictive actions.' Each egress activity is resolved independently using the most restrictive action across all matching policies. Policy ABC contributes a Print block; Policy MNO contributes a USB block. The device enforces both restrictions simultaneously: one per activity, each contributing its restriction.

Question 18

You configure an Adaptive Protection DLP policy for Exchange and Teams. The policy uses the 'Insider risk level for Adaptive Protection is Elevated risk level' condition to block external sharing. A compliance analyst asks whether the same condition can be added to a SharePoint-scoped DLP rule to block sensitive document downloads by elevated-risk users. What is the correct answer?

Accepted Answer

Correct answer: C. Microsoft Learn's DLP policy reference confirms: 'When configured in insider risk management, the Insider risk level for Adaptive Protection is will show up as condition for Exchange Online, Devices, Teams, and unmanaged cloud apps locations.' SharePoint and OneDrive are explicitly not in this list. The Adaptive Protection condition cannot be used to protect SharePoint or OneDrive data directly via DLP.

Question 19

You are writing a DLP rule for Exchange Online. The rule includes a 'Block with override' action and a user notification. You want users who believe the match is incorrect to be able to flag it for review, but you do not want to require a written justification from users who simply need to send the email for business reasons. Which override configuration achieves this?

Accepted Answer

Correct answer: C. Microsoft Learn documents two distinct override mechanisms: 'WithoutJustification' (override without requiring a reason) and 'FalsePositives' (allows the user to report it as a false positive). Option C combines them: users can bypass the block with no written justification AND get a structured channel to flag incorrect matches. A bare no-justification override (option D) allows the bypass but throws away the false-positive signal.

Question 20

Your organization wants to detect sensitive content inside images on Windows endpoints (for example, credit card numbers photographed and saved as JPG files). Which prerequisite must be met beyond the standard Endpoint DLP configuration?

Accepted Answer

Correct answer: A. Microsoft Learn confirms: OCR scanning is an optional feature enabled at the tenant level. It requires pay-as-you-go billing set up via Microsoft Syntex billing in Azure. Once enabled, 'all sensitive information types and trainable classifiers can detect characters that are in images', so you do not need separate image classifiers. Learn also confirms OCR works on Windows endpoints and the default bandwidth limit is 1,024 MB per device per day.

Question 21

A DLP policy scoped to OneDrive has an include list containing Security Group B plus one individually listed user, User A. User C is a member of Security Group B but is not individually listed in the policy. According to the policy-scoping behavior described in the manuscript, is User C in scope?

Accepted Answer

Correct answer: B. Microsoft Learn's DLP policy reference explicitly documents this intersection trap: 'when users and groups are mixed in the scoping configuration,' DLP 'only scopes policies to users to the intersection of the listed groups and users.' Learn's worked example shows that with Group1, Group2, User3, and User4 in the include list, only User3 ends up in scope, because User3 is the only user that appears in both the union of group members and the union of listed users. Here the include list mixes Security Group B with individually listed User A, so the intersection rule applies. User C is in the group union through Security Group B but is not in the user union, so User C falls outside the intersection and out of scope.

Question 22

The compliance team needs to verify which retention policies and label policies are applied to a specific SharePoint site. Which tool in the Microsoft Purview portal provides this information, and what is its key limitation?

Accepted Answer

Correct answer: A. Policy lookup, available in Data Lifecycle Management or Records Management in the Purview portal, returns the retention policies and retention label policies assigned to a specific user, site, or Microsoft 365 group. It requires exact identifiers (precise URL or email, no wildcards). Its key limitation is that it does not surface eDiscovery holds. To find those you must check separately using Get-Mailbox (InPlaceHolds) and Get-CaseHoldPolicy in Security & Compliance PowerShell.

Question 23

Your organization needs to keep all Exchange email for five years and then permanently delete it. Which of the three retention actions should you configure?

Accepted Answer

Correct answer: B. The Purview retention engine has exactly two primitive actions (retain and delete), yielding three configurable settings: retain-only (prevent deletion for a set period), delete-only (purge after a set age), and retain-then-delete (hold for a period then permanently dispose). 'Keep for five years, then delete' is the classic retain-then-delete pattern and the one most regulators require. Retain-forever is not a distinct setting in the product; it is expressed as retain-only with an unlimited duration.

Question 24

Which two workloads can only be covered by retention policies and NOT by retention labels?

Accepted Answer

Correct answer: B. Retention labels do not apply to Teams messages or Viva Engage messages. For those workloads, retention policies are the only option, and the retention period always starts from when the message was created. Exchange mailboxes, SharePoint, OneDrive, and Microsoft 365 Groups all support retention labels for item-level retention in addition to policies. This means any retention design that includes Teams or Viva Engage messaging must use at least some policies regardless of the overall labeling strategy.

Question 25

An adaptive scope for a retention policy was created yesterday targeting the Finance department. An engineer adds a new employee to the Finance group in Entra and expects the policy to apply to that user immediately. How long should the engineer realistically wait before the user is covered?

Accepted Answer

Correct answer: B. Adaptive scope queries run daily, but it can take up to five days for a new or changed query to fully populate and for the scope-details member list to reflect added or removed members. After the scope picks up the change, distribution of the policy itself can take up to seven more days. The total realistic end-to-end lag for 'I changed an Entra attribute, when is this user covered' is up to 12 days in a worst-case scenario. If a compliance deadline depends on a specific user being covered immediately, a static scope naming them explicitly is more reliable.

Question 26

An admin publishes a new retention label for Exchange. A user reports the label is not visible in Outlook four days after publication. Should the admin escalate to Microsoft support?

Accepted Answer

Correct answer: C. Published Exchange labels can take up to seven days to surface in Outlook. Four days is still within the normal propagation window. The admin should wait for the full seven-day window before checking the label policy status for an '(Error)' state and only then run Set-RetentionCompliancePolicy -RetryDistribution. Escalating to support at day four for a functioning distribution would be premature.

Question 27

A retention label is configured to start the retention period 'when an event occurs.' The label has been applied to 200 employee records. An HR administrator accidentally creates an event of the matching event type without specifying any asset IDs or keywords. What is the impact?

Accepted Answer

Correct answer: B. If you create an event without specifying asset IDs or keywords, the retention period triggers for all content carrying that event type's label, not the intended subset. This is documented as an explicit warning in the retention guidance: it is unlikely to be what you intended. The result is that the disposal clock starts for every item with that label, potentially causing premature disposal of records that should not have started their retention period yet.

Question 28

Content in a SharePoint site has had its retention period expire. The compliance team wants to permanently delete it as quickly as possible. They run the retention policy delete action, wait 15 days, then check and the content is gone from the main library but still showing up in a site collection admin's Recycle Bin view. Why, and what is the correct expectation?

Accepted Answer

Correct answer: B. Microsoft no longer hard-deletes content directly from the Preservation Hold library. Instead, expired content moves to the second-stage Recycle Bin to prevent accidental loss, where it waits for the remainder of a 93-day window that spans both first- and second-stage bins. At day 15, if cleanup has just processed the PHL (and the content sat there 30+ days), it would only now be arriving in the second-stage Recycle Bin. The 93-day window is still running. This is expected and not a bug. The content is not searchable by eDiscovery while in the Recycle Bin because it is not indexed there.

Question 29

A retention policy uses a static scope with 'All mailboxes' selected for the Exchange location. A new employee's mailbox is created two weeks after the policy was configured. Is the new mailbox covered by the policy?

Accepted Answer

Correct answer: D. When a static scope is configured as org-wide (All mailboxes, All sites, etc.), new instances created after the policy is applied are automatically included. This is documented as the default 'sticky' behavior for org-wide static scopes. The manual maintenance burden arises only when you switch to specific includes or excludes. At that point you must hand-curate the list. The RetryDistribution cmdlet fixes stuck distributions; it is not a prerequisite for new mailbox coverage.

Question 30

A document in a SharePoint site is subject to three retention settings simultaneously: a policy that retains content for 7 years (retain-only), a policy that deletes content after 4 years (delete-only), and a retention label that retains for 5 years then deletes (retain-then-delete). Applying the four principles of retention in order, when is the document permanently deleted?

Accepted Answer

Correct answer: B. Principle 1: retention wins over deletion. The 7-year retain and 5-year retain both suspend all delete actions while they are active. Principle 2: longest retention period wins. The 7-year retain-only policy wins retention. The document is retained until year 7. Principle 3: at the deletion stage, the label's delete action (explicit) beats the 4-year policy's delete action (implicit). The label's delete fires at year 7, not year 5, because principle 1 held the document until retention ended. The 4-year delete-only cannot fire while retention is active.

Question 31

A colleague insists that turning on a retention policy is a backup solution for SharePoint because 'it keeps copies of everything.' Which misconception does this reflect, and what is the correct statement?

Accepted Answer

Correct answer: B. Retention preserves a copy only when in-scope content is edited or deleted. It does not create an initial snapshot, does not protect against tenant compromise, does not give point-in-time restore, and does nothing for data outside the instrumented workloads. The Preservation Hold library stores copies of individual changed/deleted items, not full site snapshots. Retained content stays in the same tenant, within the same storage quotas. Retention and backup are different products solving different failure modes.

Question 32

An IRM case investigator wants to take an action that sends the user an email informing them of the policy concern, with the intent of deterring inadvertent future policy violations. Which case action supports this?

Accepted Answer

Correct answer: A. Microsoft Learn's IRM cases documentation describes 'Send email notice to user' as one of the case actions, used to send a notice from a pre-configured notice template. Sending a notice does not close the case. It adds the notice to the case notes queue and provides documentation that the user was informed. This is appropriate for inadvertent or accidental cases where deterrence and documentation are the goals. Option B resolves and closes the case. Option C is for legal escalation. Option D's Power Automate template notifies the manager, not the user, and has operational limitations when anonymization is on.

Question 33

What is the maximum activation window (forward scoring period after a triggering event) that an IRM policy can be configured to use?

A. 7 days
B. 14 days
C. 30 days
D. 90 days

Accepted Answer

Correct answer: B. Microsoft Learn confirms: 'Activation window is the number of days that the window activates after a triggering event. The window activates for 1 to 30 days after a triggering event occurs for any user assigned to the policy.' The 90-day figure is the past activity detection look-back for non-email signals, not the forward activation window. 7 days is the default risk-level reset timeframe for Adaptive Protection, a different concept. The activation window is configurable from 1 to 30 days on the Policy timeframes page in IRM settings.

Question 34

You have just created a Data Theft by Departing Users IRM policy. Two weeks later, no alerts have been generated even though several employees have resigned. What is the most likely reason?

Accepted Answer

Correct answer: C. Without a trigger, a user's activity is observed but does not produce alerts. The Data Theft by Departing Users template requires either an HR Connector resignation date or an Entra account-deleted triggering event; if neither has fired for the departing users, the policy is healthy but dormant. This is the most common new-administrator misconception: 'I configured a policy and nothing happened.' The distractors fail on facts: IRM policies do not have a simulation mode the way DLP does, there is no mandatory 30-day baseline requirement, and Priority User Groups are only required for the Priority Users variant.

Question 35

Your legal team asks you to preserve the visual forensic-evidence clips tied to an insider-risk case before they age out, so the footage can be entered as evidence in a proceeding six months from now. You confirm the forensic-evidence add-on was configured and capturing before the incident. Which statement about the captured clips is correct and should drive your preservation plan?

Accepted Answer

Correct answer: A. Microsoft Learn states the system retains ingested forensic evidence for 120 days, and you can export the forensic evidence if needed after the 120-day retention period. The clock starts at ingestion (capture), not at case resolution, and it is not tied to whether the case is active. Because your proceeding is six months out, 120 days is not enough; you must export or transfer the clips before they are deleted. Investigators and admins can also delete clips, so a deliberate, governed export is the only defensible way to keep footage long-term.

Question 36

An IRM alert has been generated for a user who resigned two months ago. The alert severity is High and the primary indicator is a large SharePoint download. The case investigator wants to know how far back IRM looked at the user's activity to include in the risk score. What is the correct answer?

Accepted Answer

Correct answer: D. Microsoft Learn's Limits in Insider Risk Management page confirms: 'Lookback period limits (Exchange Online): 10 days. Lookback period limits for all other signals: 90 days.' The policy timeframes page also confirms: 'For activities in the audit log, the window activates for 0 to 90 days before a triggering event occurs for any user assigned to the policy. Note: For email activities, the past activity detection period is 10 days.' SharePoint is one of those 'all other signals', so the large SharePoint download can be scored up to 90 days before the triggering event. However, if the user's email exfiltration happened more than 10 days before the trigger, that email activity would not be scored retroactively.

Question 37

You are designing an IRM deployment for a multinational organization with employees in Germany, where works council agreements require that no employee's activity be viewable by analysts outside Germany. You configure Administrative Unit scoping for the German analyst team. What additional step is critical to ensure the privacy boundary actually holds?

Accepted Answer

Correct answer: C. Microsoft Learn's permissions documentation confirms that members of Microsoft Entra ID Global Administrator, Compliance Administrator, Purview Organization Management, and Purview Compliance Administrator have the same permissions as IRM Admins and can see all data regardless of AU scoping. When a user holds a broader Entra or Purview role alongside a scoped AU role group assignment, the broader role takes precedence and bypasses the AU scope. The validation step (testing with a clean account that holds only the scoped assignment) is critical before relying on AU scoping as an enforceable privacy boundary.

Question 38

An IRM Analyst role group member opens a confirmed insider risk case that has been active for 20 days. They need to read the actual contents of the SharePoint files tied to the case alerts. They find the Content Explorer tab in the case shows 'Nothing to display.' What are the two most likely reasons?

Accepted Answer

Correct answer: A. There are two independent reasons IRM case Content Explorer shows nothing. First, content download: by default, content may need to be added to the case via the 'Add content' action, and there is a maximum number of cases that can hold downloaded content simultaneously. Second, role: IRM Analysts cannot access Content Explorer or forensic evidence in cases. Only IRM Investigators or the all-in-one IRM role group can open Content Explorer. A case with only Analyst-role members can be built but cannot be fully examined, a critical gap.

Question 39

Which Microsoft 365 license tiers include Insider Risk Management as of June 2026? Select the best answer.

Accepted Answer

Correct answer: A. The licensed tiers are Microsoft 365 E5, Microsoft Purview Suite (formerly Microsoft 365 E5 Compliance), the Microsoft 365 E5 Insider Risk Management standalone SKU, Microsoft 365 A5, Microsoft Purview Suite FLW (renamed from F5 Compliance in October 2025), and Microsoft 365 G5. E5 is the most common path, but organizations on E3 can reach IRM through the Purview Suite add-on or the standalone IRM SKU. Microsoft 365 E3 alone does not include IRM, and Defender for Endpoint licensing is unrelated to IRM entitlement. The Microsoft Learn service description confirms IRM is included in 'Microsoft 365 E5/A5/G5, Microsoft Purview Suite/EDU/GOV/FLW and Microsoft Defender + Purview Suite FLW, and Microsoft 365 E5/A5/F5/G5 Insider Risk Management.'

Question 40

You are configuring IRM for the first time and want to see device-level indicators (USB copies, prints, cloud-sync copies) working in your trial tenant. You have completed the policy configuration and enabled Device indicators globally. After 24 hours, no device-level activity appears. What is the first thing to verify?

Accepted Answer

Correct answer: A. Device indicators flow through Purview device onboarding (the same channel as Endpoint DLP), not through DLP policy alert severity settings or Defender for Endpoint alert sharing. Without an onboarded device, device-class indicators (USB copy, file print, file copy to cloud sync) never fire. This is the documented first check for missing device activity in IRM. Priority User Group membership is not a prerequisite for device activity to be scored. It is a risk score booster, not a signal prerequisite.

Question 41

An administrator asks how many active cases IRM can hold at one time. What is the limit documented in the manuscript?

Accepted Answer

Correct answer: D. Microsoft Learn's Limits in Insider Risk Management page confirms: 'Maximum number of active cases: 100.' This is a genuine operational planning constraint. Active cases are retained indefinitely (they never expire), which makes hitting the 100-case ceiling a real risk for high-volume environments that do not close cases promptly.

Question 42

Your IRM deployment has been running for six weeks. During an investigation you notice that a user's risk score seems unexpectedly high for what appears to be routine activity. Which of the following is the LEAST reliable method for explaining why the score is elevated?

Accepted Answer

Correct answer: C. Microsoft does not publish the exact base-score formula, the precise weighting per indicator, or the decay model within the activation window. The portal exposes alert severity (Low, Medium, High); the underlying score-to-severity boundary is not documented as a fixed band. The model is adaptive and Microsoft does not document how it is trained. As a result, the absolute numeric risk score cannot be used to determine exactly which activity contributed the most weight. It is a directional signal, not an auditable calculation. Options A, B, and D are all documented investigative inputs: sequence detection (B) is visible in the User Activity timeline; Priority User Group membership and high-impact user detection (D) are documented risk score boosters; cumulative exfiltration detection (A) is a documented ML model input.

Question 43

DSPM for AI activates a one-click collection policy named 'DSPM for AI - Detect sensitive info shared with AI via network.' Compliance reviewers complain that activity explorer shows the detection but never the actual prompt and response text. What is the correct reason and fix?

Accepted Answer

Correct answer: D. For collection policies, no prompt or response is displayed if the content-capture option is not selected. The one-click policy 'DSPM for AI - Detect sensitive info shared with AI via network' does not select that option when it is automatically created, but you can manually edit the policy afterward and enable content capture. That is the documented fix for seeing prompt and response text from this policy.

Question 44

Which of the following is required to see the actual text of a Microsoft 365 Copilot prompt and response inside DSPM for AI's Activity Explorer?

Accepted Answer

Correct answer: A. Reading the actual prompt and response text inside AI Interaction events requires either the Content Explorer Content Viewer or the Purview Data Security AI Content Viewer role group. Standard admin roles (including Entra Compliance Administrator, Entra Global Administrator, and the Purview Compliance Administrator role group) can run DSPM for AI, create policies, and read reports, but the Microsoft Learn DSPM for AI permissions table explicitly marks both Global Administrator and Compliance Administrator as not sufficient for 'View the prompts and responses within AI Interaction events from activity explorer.'

Question 45

A compliance analyst needs to answer two different questions: (1) 'In which SharePoint and OneDrive locations across the tenant do documents containing the Credit Card Number SIT currently reside?' and (2) 'Over the last week, which users downgraded a Confidential label to General, and from which device?' Which Microsoft Purview data-classification tool answers each question?

Accepted Answer

Correct answer: C. These are the two distinct lenses of data classification. Content Explorer provides a snapshot of where sensitive information currently resides: it indexes items across supported workloads and lets you filter by SIT or label to find their locations. Activity Explorer instead provides a historical view of what is being done with labeled content: label applied/changed/downgraded, DLP matches, endpoint egress, and so on. Activity Explorer's data comes from the Microsoft 365 unified audit logs and reports on up to 30 days of activity, including device name for endpoint events. A label downgrade by a specific user on a specific device is an activity, so it belongs to Activity Explorer.

Question 46

During a compromised-account investigation, an analyst needs to determine whether an attacker read specific emails in the victim's mailbox using a mail client (not just that the email arrived). Which audit event provides this evidence, and what property distinguishes 'desktop Outlook pulled down a whole folder' from 'individual messages were opened'?

Accepted Answer

Correct answer: A. MailItemsAccessed is the audit event that records when mail data is accessed via mail protocols and clients (POP, IMAP, MAPI, EWS, Exchange ActiveSync, REST). Microsoft Learn confirms it is part of Audit (Standard) functionality and is enabled by default for users assigned an Office 365 E3/E5 or Microsoft 365 E3/E5 license. The MailAccessType property distinguishes two access patterns: Bind means individual messages were opened (each identified by InternetMessageId, aggregated in 2-minute windows); Sync means a desktop Outlook client pulled down a folder. Microsoft's guidance: if a Sync occurred in the session context of the suspicious activity, assume every item in that folder was compromised.

Question 47

During an investigation of a potentially compromised service account, a security analyst discovers that Get-MailboxAuditBypassAssociation returns True for the account in question. What are the full implications of a MailboxAuditBypassAssociation set to True for a service account?

Accepted Answer

Correct answer: D. Microsoft Learn confirms: 'When you configure a user or computer account to bypass mailbox audit logging, access or actions taken by the user or computer account to any mailbox isn't logged.' The specific listing: (1) Mailbox owner actions that the bypassed users perform aren't logged; (2) Delegate actions that the bypassed users perform on other users' mailboxes (including shared mailboxes) aren't logged; (3) Admin actions that the bypassed users perform aren't logged. This is a complete audit blackout for that account. Organizations should audit the bypass list at regular intervals.

Question 48

A security engineer is automating large-scale audit log extraction and writes a script using Search-UnifiedAuditLog with a single SessionId. After retrieving 43,000 records in the first few pages, the engineer switches the -SessionCommand from ReturnLargeSet to ReturnNextPreviewPage on subsequent calls to get sorted results. The final result set has exactly 10,000 records. What happened?

Accepted Answer

Correct answer: D. Microsoft Learn explicitly documents this: 'Always use the same SessionCommand value for a given SessionId value. Don't switch between ReturnLargeSet and ReturnNextPreviewPage for the same session ID. Otherwise, the output is limited to 10,000 results.' ReturnLargeSet handles up to 50,000 records but returns unsorted results; ReturnNextPreviewPage handles up to 5,000 records with sorted results. To get sorted results from a large dataset, collect with ReturnLargeSet and sort the assembled collection afterward in PowerShell.

Question 49

An organization's audit log retention policy configuration has the following custom policies in place: Policy A (priority 5): retain Exchange records for 7 years; Policy B (priority 3): retain Exchange records for 30 days. The Premium default policy retains Exchange/SharePoint/OneDrive/Entra records for 1 year. An Exchange audit record is generated today for an E5 user. Which policy applies and why?

Accepted Answer

Correct answer: A. Audit retention policy priority rules: (1) lower priority NUMBER = higher priority (wins); (2) any custom policy always outranks the Premium built-in default policy. Policy B has priority 3, Policy A has priority 5, so Policy B wins. Microsoft Learn confirms: 'All custom audit log retention policies (created by your organization) take priority over the default retention policy.' Therefore Policy B (30 days) applies to this Exchange record for the E5 user. The result is 30-day retention despite the Premium default and the 7-year custom policy also matching.

Question 50

Activity Explorer shows data for which maximum time window, and where does it pull its data from?

Accepted Answer

Correct answer: B. Activity Explorer reports on up to 30 days of data. That 30-day ceiling is not configurable. Its data is sourced from the unified audit log: Activity Explorer transforms and surfaces audit data in its own UI. Because it draws from the same pipeline, it shares the audit log's ingestion latency. For anything older than 30 days, the audit log itself (or a SIEM fed from the Management Activity API) is the correct tool.

Question 51

In DSPM for AI activity explorer, you want to confirm a specific Microsoft 365 Copilot interaction was flagged because it contained a credit card number, even though no active policy targeted it. Which activity explorer event, and under what condition, surfaces that detection?

Accepted Answer

Correct answer: D. For Microsoft 365 Copilot and Copilot Chat, the Sensitive info types event (sensitive information types found while a user interacted with a generative AI site) requires auditing to be turned on but does not require any active policy. That is exactly the case described: a credit card SIT is surfaced from a Copilot interaction purely on the strength of auditing, with no DLP rule needed.

Question 52

A Contoso administrator creates a 10-Year Audit Log Retention add-on retention policy for all Exchange records, assigns the add-on licenses to the relevant users, and believes records from the past 3 years are now covered under the 10-year policy. The administrator is wrong. Why?

Accepted Answer

Correct answer: A. Microsoft Learn is explicit: 'The audit item lifetime for data is determined when you add it to the auditing pipeline and is based on the licensing defaults or applicable retention policies. Any changes to licensing or applicable retention policies change the expiration time of the audit data after updating. These changes don't affect any previously committed items.' Also: 'This policy isn't retroactive and can't retain audit logs that were generated before the 10-year audit log retention policy was created.' Records already committed under shorter lifetimes keep those lifetimes regardless of subsequent changes.

Question 53

After activating DSPM for AI default policies, an admin checks back almost immediately and sees empty Reports and an empty activity explorer. Microsoft 365 Copilot is licensed and auditing is on. What is the most likely explanation?

Accepted Answer

Correct answer: D. Microsoft documents that you should allow at least 24 hours for new DSPM for AI policies to collect data and display results, and to reflect changes you make to default settings. The walkthrough similarly notes you need to wait at least a day for the Reports to be populated. So an immediate empty view with auditing on and Copilot licensed is expected timing, not a misconfiguration.

Question 54

A production must deliver RMS-protected (rights-managed) email in a decrypted, readable form to opposing counsel's review platform. You already hold the RMS Decrypt role. In the export settings, which export format choice actually delivers the decrypted messages?

Accepted Answer

Correct answer: B. Holding the RMS Decrypt role (assigned to the eDiscovery Manager role group by default) is necessary but not sufficient: the export FORMAT determines whether decryption actually lands. Microsoft Learn states that to enable decryption of RMS-protected messages when you export them, you must export the search results as individual messages (.msg). The 'Create PSTs for messages' option can leave rights-protected mail still encrypted in the PST. So for any production that must deliver decrypted protected mail, choose individual messages, not PST out of habit. (Decryption happens on the way into preview/export, and only Microsoft encryption technologies such as Azure RMS and sensitivity labels are supported; S/MIME, DKE, HYOK, and on-premises RMS are not.)

Question 55

An engineer is told to preserve a departing employee's mailbox for a matter. The plan is to delete the employee's account first, then place an eDiscovery hold on the resulting inactive mailbox. Why is this plan wrong, and what is the correct sequence?

Accepted Answer

Correct answer: A. Hold policies aren't supported for inactive mailboxes; Microsoft's guidance is that you must place holds on active mailboxes before the mailbox is deleted. When a mailbox that already has an active eDiscovery hold is deleted, its content is preserved as an inactive mailbox and stays searchable and exportable for as long as the hold or case remains active. Placing the hold first (and confirming it applied) is the whole mechanism that turns a departing user's mailbox into a preserved inactive mailbox. Do it in the reverse order and no inactive mailbox is created; the data is gone.

Question 56

Counsel wants to preserve only documents that mention 'Project Falcon' across several custodians, so you build a query-based hold using a keyword condition. Some of those custodians' mailboxes contain sensitivity-label-encrypted attachments and other partially indexed files that are central to the matter. What is the defensibility risk, and what does Microsoft recommend?

Accepted Answer

Correct answer: B. Microsoft Learn warns that query-based holds using conditions beyond Date, Participants, or Type (such as keywords or paths) might not apply to encrypted or partially indexed items, because that content couldn't be indexed to evaluate against the query. The result is a hold that can silently fail to preserve exactly the items most likely to matter. Microsoft's guidance is to limit query-based hold conditions to Date, Participants, and Type, or apply a location-based (infinite) hold to guarantee coverage. When broad, complete preservation is the legal obligation, a location-based hold is the defensible default; a keyword query-based hold is only safe when counsel agrees the narrowed scope is genuinely acceptable.

Question 57

A litigation matter was run entirely by one eDiscovery Manager who was the sole member of the case. That person has left the company and their account is deleted. Legal now needs the case's holds and review sets. A colleague who is also in the eDiscovery Manager role group cannot see the case at all, and the Organization Management admin also cannot open it. Who can regain access to the stranded case, and how?

Accepted Answer

Correct answer: C. Case membership is the access boundary in eDiscovery: you can only open a case you created or were added to. When the only member of a case is offboarded, the case becomes a black box. Microsoft states this explicitly: no one, including Organization Management or another eDiscovery Manager, can access such a case because they aren't a member. The single escape is an eDiscovery Administrator, who is the one role that can view and access every case in the organization and can add themselves (or another manager) as a member to recover it. This is exactly why you keep at least one standing eDiscovery Administrator and never create single-member cases.

Question 58

Counsel wants a query-based eDiscovery hold that preserves only content matching specific keywords, to save storage. The custodians' mailboxes contain many encrypted and partially indexed items that are likely central to the matter. What is the correct guidance?

Accepted Answer

Correct answer: D. Query-based holds are unreliable for exactly the content most likely to matter. Microsoft warns that queries using conditions beyond dates, participants, and item types (such as keywords or paths) might not apply to encrypted or partially indexed items, so the hold may not preserve them as intended. To ensure coverage, limit query-based hold conditions to Date, Participants, and Type, or apply a location-based (infinite) hold. Two related nuances: a query-based hold always includes the partially/unindexed items in a held location (it can't evaluate them, so it keeps them), and it won't cull non-matching content at all if more than five holds of any type sit on a location. When broad preservation is the obligation, location-based is the defensible default.

Question 59

You are collecting Teams content for a case. You need (1) the messages from a Teams group chat among four people, and (2) the files that were shared inside a private channel of a team. Which content locations must you search for each?

Accepted Answer

Correct answer: B. Teams content is journaled to Exchange and SharePoint locations that depend on the conversation type. Messages in 1:1 and group (1:N) chats are stored in the Exchange Online mailbox of every participant, so you search each participant's mailbox. Files shared in a private channel are stored in a dedicated SharePoint site that is separate from the parent team's site, so you must identify and search that channel's own site. Missing either location silently loses evidence: one side of a conversation, or every file in the private channel.

Question 60

You're collecting Microsoft Teams content for a case. A custodian participated in a 1:N group chat, posted messages in a standard channel, and shared a file in a private channel. Which set of locations must you search to capture all three?

Accepted Answer

Correct answer: B. Teams content is journaled to different locations by conversation type, and collecting the wrong one silently drops evidence. Messages in 1:1 and group (1:N) chats are stored in the Exchange mailbox of every participant, so you search each participant's mailbox. Standard channel messages are stored in the mailbox associated with the parent team. Files shared in a private (or shared) channel live in that channel's own dedicated SharePoint site, separate from the parent team site, so you must identify and search the channel's site, not the team's. (Private-channel messages themselves go to a dedicated private-channel mailbox.)

Question 61

In a premium review set with analytics run, a reviewer wants to (1) read only the single message in each email thread that already contains all prior replies, and (2) make sure they never cull a message whose body is duplicative but which carries an attachment no other message in the thread has. Which two email-threading fields support this?

Accepted Answer

Correct answer: C. Email threading populates two fields for this purpose. Is Inclusive marks the message that contains all the unique content of the thread up to that point, so reviewers can read the inclusive messages and get full context instead of opening every reply. Has Unique Attachments flags an email that carries an attachment not present on any other message in the thread, so a message whose body is fully duplicative is not culled when it holds the only copy of a document. Reading inclusive messages plus anything with unique attachments gives defensible thread coverage, which is safer than Outlook conversation grouping on forks and inline edits.

Question 62

Your legal team wants to use premium eDiscovery features (review sets, analytics, tagging) to analyze the mailbox and OneDrive of one custodian under investigation. The three eDiscovery managers and two reviewing attorneys who will operate the case all hold Microsoft 365 E3. Whose licensing determines whether premium analysis is allowed?

Accepted Answer

Correct answer: A. The premium eDiscovery license requirement attaches to the data subject (the custodian whose mailbox, OneDrive, or other content is analyzed), not to the people operating the tool. Microsoft Learn states that to analyze a user's data with premium features enabled, that user must have Office 365/Microsoft 365 E5, or an equivalent add-on (Purview Suite or the Microsoft 365 eDiscovery and Audit add-on on E3/E1). Administrators, compliance officers, and legal reviewers assigned to the case as members don't need E5 to collect, view, and analyze premium data. (Operators and custodians still need at least E3 to participate in eDiscovery at all.) So premium exposure is scoped by who you analyze, not who clicks the buttons.

Question 63

Classic standalone Content Search was retired on which date, and where does Content Search functionality live now?

Accepted Answer

Correct answer: C. Microsoft retired all classic eDiscovery experiences, including classic Content Search, classic eDiscovery (Standard), and classic eDiscovery (Premium), on August 31, 2025. Multiple Microsoft Learn pages carry this explicit caution: 'Microsoft retired all classic eDiscovery experiences on August 31, 2025.' All Content Search functionality is now inside the unified eDiscovery experience in the Microsoft Purview portal, available as a dedicated Content Search case.

Question 64

A production must deliver decrypted, rights-protected (RMS/sensitivity-label-encrypted) email to opposing counsel. The operator holds the RMS Decrypt role. Out of habit, they configure the export with 'Create PSTs for messages.' Why can this leak encrypted mail, and what is the correct export configuration?

Accepted Answer

Correct answer: B. eDiscovery decrypts content protected with Microsoft encryption technologies during preview and export, provided you hold the RMS Decrypt role (assigned to the eDiscovery Manager role group by default). But the export format decides whether decryption actually lands: Microsoft's documentation states that to enable decryption of RMS-protected messages on export you must export the search results as individual messages (.msg). The PST option can carry rights-protected mail out still encrypted. So for any adverse production of decrypted protected mail, choose 'Create .msg files for messages,' not PST.

SC-401 practice questions, with full explanations

Sensitivity Labels and Data Classification (10 questions)