Your organization has a DLP policy that blocks copying sensitive files to USB drives. However, you notice that some users are still able to copy files to USB drives. You have verified that the policy is enabled and the users are in scope. What should you investigate next?

Check if the devices have the latest version of the Microsoft Purview extension installed.

Verify that the users have not been granted an override permission in the policy.

Ensure that the devices are connected to the internet to receive policy updates.

Check if the USB drives are encrypted with BitLocker To Go.

Your organization has Endpoint DLP deployed. You need to identify which users have been overriding the DLP policy by providing justifications. Where should you look to find this information?

Windows Event Viewer on each device > DLP logs

Microsoft Purview compliance portal > Alerts

Activity explorer, filtering by 'Justification' in the activity details.

Microsoft 365 Defender portal > Advanced hunting

Your company wants to prevent users from copying sensitive data to USB drives, but you are concerned about the performance impact of scanning every file on the endpoint. You need to implement a solution that blocks the copy action at the moment it is attempted without pre-scanning all files. What should you configure?

Enable just-in-time protection for the 'Copy to removable storage' activity in the DLP policy.

Configure a scheduled task to periodically check for sensitive files on USB drives.

Run a full scan of all files on the endpoint and apply labels to sensitive files.

Use a DLP policy with 'Audit only' for the copy activity and review logs weekly.

A law firm uses Endpoint DLP to protect confidential client documents. They want to allow users to copy sensitive data to a secure internal share, but block copying to personal cloud storage. They also want to require a justification when users attempt to copy to the internal share. What should you configure?

Create a rule that blocks all copy activities and then add an exception for the internal share.

Create two rules: one that blocks copy to cloud storage, and another that allows copy to the internal share with 'Block with override' and justification.

Use a single rule with the action 'Block with override' for all copy activities, and rely on users to justify every copy.

Enable 'Just-in-time protection' and set the policy to 'Audit only'.

Microsoft Certified:Information Security Administrator Associate

Domain 2Objective 2

Implement and Monitor Microsoft Purview Endpoint DLP SC-401 Practice Questions (Page 6)

Part of the Implement data loss prevention and retention domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

5concepts

30–35%of the exam

Questions 26–30

26expert · hard
Your organization has a DLP policy that blocks copying sensitive files to USB drives. However, you notice that some users are still able to copy files to USB drives. You have verified that the policy is enabled and the users are in scope. What should you investigate next?
Select an answer first
27expert · hard
Your organization has Endpoint DLP deployed. You need to identify which users have been overriding the DLP policy by providing justifications. Where should you look to find this information?
Select an answer first
28application · medium
Your DLP policy must block the sharing of sensitive files via email from Outlook on Windows devices. You have already created a policy that includes the sensitive info type. What activity should you configure in the rule?
Select an answer first
29application · medium
Your company wants to prevent users from copying sensitive data to USB drives, but you are concerned about the performance impact of scanning every file on the endpoint. You need to implement a solution that blocks the copy action at the moment it is attempted without pre-scanning all files. What should you configure?
Select an answer first
30application · medium
A law firm uses Endpoint DLP to protect confidential client documents. They want to allow users to copy sensitive data to a secure internal share, but block copying to personal cloud storage. They also want to require a justification when users attempt to copy to the internal share. What should you configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.

Implement and Monitor Microsoft Purview Endpoint DLP SC-401 Practice Questions (Page 6)

Questions 26–30

Your organization has a DLP policy that blocks copying sensitive files to USB drives. However, you notice that some users are still able to copy files to USB drives. You have verified that the policy is enabled and the users are in scope. What should you investigate next?

Your organization has Endpoint DLP deployed. You need to identify which users have been overriding the DLP policy by providing justifications. Where should you look to find this information?

Your DLP policy must block the sharing of sensitive files via email from Outlook on Windows devices. You have already created a policy that includes the sensitive info type. What activity should you configure in the rule?

Keep studying — Implement data loss prevention and retention