Your organization has a mix of Windows and macOS devices. You need to implement Endpoint DLP with just-in-time protection for cloud uploads. However, you have a limited budget and cannot afford to deploy the Microsoft Purview extension to all devices at once. You need to prioritize which devices to onboard first. Which approach should you take?

Onboard devices that handle the most sensitive data, such as finance and HR, first, and then expand to other departments.

Onboard all devices at once by using a free third-party DLP agent.

Onboard only devices that are already enrolled in Microsoft Intune.

Onboard all Windows devices first because macOS does not support just-in-time protection.

You have deployed Endpoint DLP and need to review which users have attempted to upload sensitive files to personal cloud storage. You want to see the details of each attempt, including the file name and the user. Where should you look?

Microsoft Entra ID sign-in logs.

Microsoft Intune device compliance reports.

Activity Explorer in the Microsoft Purview compliance portal.

Microsoft Defender for Endpoint alerts.

Your organization has deployed Endpoint DLP. You need to monitor endpoint activities in real time and receive alerts when a user attempts to copy sensitive data to a USB drive. You have already configured a DLP policy with the appropriate actions. What else should you configure to receive real-time alerts?

Create an alert policy in Microsoft Purview that triggers when the DLP policy matches.

Configure the DLP policy to send an email to the security team on every match.

Use Microsoft 365 Defender to create a custom detection rule for USB copy events.

Enable 'Just-in-time protection' to generate alerts for every user action.

A healthcare organization uses Endpoint DLP to protect patient records. They need to block sending sensitive data via email from Outlook desktop, but allow sending via a secure internal web portal. What should you configure in the DLP policy?

Configure the policy to use 'Just-in-time protection' and let users decide whether to send.

Create two separate rules: one for the 'Exchange' location to block email, and one for the 'Endpoint DLP' location to allow the web portal.

Create a rule that targets 'Exchange' and 'Endpoint DLP' locations, and set the action to 'Block' for email and 'Allow' for the web portal.

Use a single rule with the condition 'Content contains' and set the action to 'Block' with an exception for the web portal domain.

Where can an administrator view detailed information about endpoint DLP activities, such as the user, device, and file involved in a policy match?

Microsoft Intune > Endpoint analytics

Microsoft Purview compliance portal > Activity explorer

Microsoft Defender for Cloud Apps > Activity log

Microsoft 365 admin center > Device management

Microsoft Certified:Information Security Administrator Associate

Domain 2Objective 2

Implement and Monitor Microsoft Purview Endpoint DLP SC-401 Practice Questions (Page 5)

Part of the Implement data loss prevention and retention domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

5concepts

30–35%of the exam

Questions 21–25

21expert · medium
Your organization has a mix of Windows and macOS devices. You need to implement Endpoint DLP with just-in-time protection for cloud uploads. However, you have a limited budget and cannot afford to deploy the Microsoft Purview extension to all devices at once. You need to prioritize which devices to onboard first. Which approach should you take?
Select an answer first
22application · medium
You have deployed Endpoint DLP and need to review which users have attempted to upload sensitive files to personal cloud storage. You want to see the details of each attempt, including the file name and the user. Where should you look?
Select an answer first
23expert · hard
Your organization has deployed Endpoint DLP. You need to monitor endpoint activities in real time and receive alerts when a user attempts to copy sensitive data to a USB drive. You have already configured a DLP policy with the appropriate actions. What else should you configure to receive real-time alerts?
Select an answer first
24application · medium
A healthcare organization uses Endpoint DLP to protect patient records. They need to block sending sensitive data via email from Outlook desktop, but allow sending via a secure internal web portal. What should you configure in the DLP policy?
Select an answer first
25foundation · easy
Where can an administrator view detailed information about endpoint DLP activities, such as the user, device, and file involved in a policy match?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.

Implement and Monitor Microsoft Purview Endpoint DLP SC-401 Practice Questions (Page 5)

Questions 21–25

You have deployed Endpoint DLP and need to review which users have attempted to upload sensitive files to personal cloud storage. You want to see the details of each attempt, including the file name and the user. Where should you look?

A healthcare organization uses Endpoint DLP to protect patient records. They need to block sending sensitive data via email from Outlook desktop, but allow sending via a secure internal web portal. What should you configure in the DLP policy?

Where can an administrator view detailed information about endpoint DLP activities, such as the user, device, and file involved in a policy match?

Keep studying — Implement data loss prevention and retention