Microsoft Certified:Information Security Administrator Associate
Domain 3Objective 2
Manage Information Security Alerts and Activities SC-401 Practice Questions (Page 4)
Part of the Manage risks, alerts, and activities domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)
38questions here
8free pages
9concepts
30–35%of the exam
Questions 16–20
- 16
Which licensing action is required for a user to generate and retain Microsoft Purview Audit (Premium) logs?
Select an answer first - 17
Which of the following is a valid retention duration for a custom audit retention policy in Microsoft Purview?
Select an answer first - 18
A security analyst is investigating a potential data exfiltration incident where a user copied sensitive files to a personal cloud storage service. The analyst needs to determine the exact sequence of events, including the file names, the user's actions, and the destination. The analyst has access to Microsoft Purview Activity Explorer. What is the most effective way to analyze the captured activities?
Select an answer first - 19
Which Microsoft Purview solution is specifically designed to investigate insider risk activities?
Select an answer first - 20
Fabrikam has a mix of Microsoft 365 E3 and E5 licenses. The compliance team wants to use Purview Audit (Premium) to investigate activities for all users, but only E5 users currently have Premium features. What should you do to enable Premium audit for the E3 users?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.