SC-400 Information Protection & Governance 2 — Questions and Answers
Question 1: A compliance administrator needs to prevent users from emailing documents labeled 'Confidential' outside the organization. Which Microsoft Purview feature should they configure?
- Data Loss Prevention policy (Correct answer)
- Sensitivity label auto-labeling
- Retention policy
- Communication compliance policy
Correct answer: Data Loss Prevention policy
DLP policies can block or restrict sharing of content with specific sensitivity labels to external recipients.
Question 2: Which encryption method does Microsoft Purview Information Protection use to protect labeled documents so that access persists even when files leave the organization?
- S/MIME encryption
- Azure Rights Management (Azure RMS) (Correct answer)
- BitLocker encryption
- TLS encryption
Correct answer: Azure Rights Management (Azure RMS)
Azure Rights Management encrypts files and enforces usage rights that travel with the document regardless of location.
Question 3: An organization wants to automatically apply a 'Highly Confidential' sensitivity label to emails containing credit card numbers. Which capability enables this?
- Manual labeling
- Recommended labeling
- Auto-labeling policies (Correct answer)
- Default label policy
Correct answer: Auto-labeling policies
Auto-labeling policies in Microsoft Purview scan content and apply sensitivity labels automatically based on sensitive information types.
Question 4: A user tries to open a Rights Management-protected document but receives an 'Access Denied' error. The document owner has left the company. Which role can recover access?
- Global Administrator
- Security Reader
- Super User in Azure RMS (Correct answer)
- Compliance Administrator
Correct answer: Super User in Azure RMS
The Azure RMS Super User role grants full decryption rights over all protected content in the tenant, enabling recovery scenarios.
Question 5: What is the primary difference between sensitivity labels and Azure Information Protection (AIP) unified labels?
- Sensitivity labels only work in Office apps; AIP labels work across all platforms
- AIP unified labels are the same labels managed in Microsoft Purview compliance portal (Correct answer)
- Sensitivity labels cannot apply encryption; AIP labels can
- AIP labels are deprecated and replaced by a separate labeling system
Correct answer: AIP unified labels are the same labels managed in Microsoft Purview compliance portal
Microsoft migrated AIP labels to the Microsoft Purview compliance portal; unified labels are managed centrally and used by both services.
Question 6: Which sensitivity label setting prevents users from copying text from a protected Word document to an unprotected application?
- Watermarking
- Content marking
- Encryption with restricted permissions (no copy) (Correct answer)
- Header and footer settings
Correct answer: Encryption with restricted permissions (no copy)
Encryption settings within a sensitivity label can restrict usage rights such as copying, preventing extraction of content to other apps.
Question 7: A company needs sensitivity labels to appear in third-party applications like Adobe Acrobat. What must be deployed?
- Microsoft Defender for Endpoint
- Azure Information Protection unified labeling client (Correct answer)
- Microsoft Intune MDM policy
- Microsoft Entra ID Conditional Access
Correct answer: Azure Information Protection unified labeling client
The AIP unified labeling client extends sensitivity label support to applications beyond built-in Microsoft 365 apps, including Adobe Acrobat.
SC-400 Information Protection & Governance 2
A compliance administrator needs to prevent users from emailing documents labeled 'Confidential' outside the organization.
Which Microsoft Purview feature should they configure?