SC-400 Cheat Sheet 2026

The 30 highest-yield SC-400 facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. An organization wants to track when users downgrade a sensitivity label (e.g., from 'Confidential' to 'General'). Which tool provides this visibility? → Activity Explorer
2. Which built-in trainable classifier would be most appropriate for identifying internal company strategy documents? → Business plan
3. Which DLP policy priority rule applies when multiple DLP policies match the same content? → The most restrictive rule across all matching policies takes effect
4. An organization needs to retain records based on when a specific product model is discontinued. Which event type should be created in Microsoft Purview? → Product discontinuation event type
5. What is the PRIMARY purpose of obtaining SC-400 certification in Microsoft Certified Information Protection and Compliance Administrator Associate? → To demonstrate verified competency and adherence to professional standards
6. Which Microsoft Purview feature allows you to see exactly which DLP rule matched a specific email and why it was blocked? → DLP policy reports
7. An organization needs sensitivity labels to appear in Office for the web but not in the Office desktop apps for a specific user group. How is this achieved? → Publish a label policy scoped to specific users with app-specific settings
8. What is the value of continuing education in audit and monitoring for SC-400 professionals? → It keeps professionals current with evolving standards and practices
9. Which connector type must be deployed to allow Insider Risk Management to trigger alerts based on employee performance review data? → HR data connector
10. An organization wants DLP policies to apply to endpoints (Windows 10/11 devices). What must be enabled first? → Microsoft Purview compliance portal device onboarding
11. A compliance administrator must ensure that custodians acknowledge their legal hold obligations. Which eDiscovery Premium feature automates this process? → Custodian communications (hold notifications)
12. Which sensitive information type would best detect European Union passport numbers across multiple EU member states? → EU Passport Number built-in sensitive information type
13. Your organization needs to demonstrate GDPR compliance to auditors. Which Microsoft Purview feature provides pre-built assessments mapped to GDPR requirements? → Compliance Manager
14. What is the purpose of the 'mandatory labeling' setting in a sensitivity label policy? → Requires users to apply a label before saving or sending a document
15. Which sensitivity label encryption configuration allows the label to expire access to content after a specific number of days? → Assign permissions now — Content expiration
16. What is the primary objective of Identity & Access Management (IAM)? → To ensure secure access to critical systems and data.
17. What is the role of risk assessments in internal audits? → They help identify areas at risk for non-compliance.
18. A security analyst notices audit records are missing for the period when a suspected breach occurred. What is the most likely reason? → Auditing was not enabled during that period
19. What role does collaboration play in audit and monitoring for SC-400 professionals? → It enhances outcomes through diverse perspectives and shared expertise
20. A risk manager needs to export Compliance Manager assessment data for board reporting. What export format does Compliance Manager natively support? → Excel (.xlsx)
21. What is the recommended approach when managing conflicting priorities in SC-400? → Prioritize based on impact and urgency
22. What is the PRIMARY reason for regulatory compliance in the Microsoft Certified Information Protection and Compliance Administrator Associate profession? → To protect public safety, ensure quality standards, and maintain professional integrity
23. Which Microsoft Purview feature enables administrators to understand what types of sensitive data exist in their environment before configuring policies? → Data classification dashboard in Content Explorer
24. An organization wants to export audit log results for analysis in a SIEM tool. What file format does the Microsoft Purview audit log export produce? → CSV
25. When configuring an audit log search, which date/time zone do the start and end times correspond to? → UTC (Coordinated Universal Time)
26. Which setting in Insider Risk Management enables the system to detect risky browsing behavior such as visiting job search or competitor websites? → Risky browsing indicators
27. How does encryption help in data loss prevention? → It allows data access only with a valid encryption key.
28. An insider risk investigator needs to correlate audit data with user behavior analytics. Which Microsoft Purview solution provides this integration natively? → Insider Risk Management
29. Which of the following actions can an Insider Risk Management Analyst perform that an Insider Risk Management Viewer cannot? → Triage alerts and add case notes
30. What does the 'indexing' status of a custodian's content location indicate in eDiscovery Premium? → Partially indexed items are being reprocessed to make them fully searchable