Microsoft Certified:Information Security Administrator Associate
Domain 3Objective 2
Manage Information Security Alerts and Activities SC-401 Practice Questions (Page 1)
Part of the Manage risks, alerts, and activities domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)
38questions here
8free pages
9concepts
30–35%of the exam
Questions 1–5
- 1
Contoso has enabled the integration between Microsoft Purview and Microsoft Defender XDR. The security team receives a DLP alert in Purview and a file policy alert in Defender for Cloud Apps about the same user. The team wants to investigate both alerts together and take coordinated action. What is the most efficient approach?
Select an answer first - 2
Which Microsoft Purview tool provides a visual, filterable view of activities captured by data loss prevention and other policies?
Select an answer first - 3
An insider risk alert in Microsoft Purview indicates that a user has been downloading large volumes of files from SharePoint and sending them to a personal email address. You need to investigate the user's activities to confirm the behavior. Which two tools should you use together?
Select an answer first - 4
An organization needs to ensure that all users in the legal department have their activities in Microsoft Purview Audit (Premium) logged, including detailed events like email access and document previews. The organization currently has Audit (Standard) enabled for all users. What is the most efficient way to enable Audit (Premium) for the legal department?
Select an answer first - 5
Which of the following is a common action you can take when responding to a DLP alert in Microsoft Purview?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.