Microsoft - SC-401: Administering Information Security in Microsoft 365

Sample Questions

• Create and manage data loss prevention (DLP) policies.
• Review classified content by using Content explorer.

Explanation:

The table below lists the three role groups and the roles that are assigned to the role groups by default.

Reference: Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview

Explanation:

Retention labels don't prevent users from deleting files from their original source location, but retention ensures items are retained in a special location if they were deleted.

When content has retention settings assigned to it, that content remains in its original location. Most of the time, people continue to work with their documents or mail as if nothing's changed. But if they edit or delete content that's included in the retention policy, a copy of the content is automatically retained.

• For SharePoint and OneDrive sites: The copy is retained in the Preservation Hold library.

• For Exchange mailboxes: The copy is retained in the Recoverable Items folder.

• For Teams, Viva Engage messages, and interactions with Microosft 365 Copilot and Microsoft Copilot: The copy is retained in a hidden folder named SubstrateHolds as a subfolder in the Exchange Recoverable Items folder.

Reference: Learn about retention policies and retention labels

• Name: Policy1
• Retain items for a specific period: 5 years
• Locations to apply the policy: Exchange email, SharePoint sites

Explanation:

Preservation Lock locks a retention policy or retention label policy so that no one—including a global admin—can turn off the policy, delete the policy, or make it less restrictive. This configuration might be needed for regulatory requirements and can help safeguard against rogue administrators.

When a retention policy is locked:

• No one can disable the policy or delete it
• Locations can be added but not removed
• You can extend the retention period but not decrease it

When a retention label policy is locked:

• No one can disable the policy or delete it
• Locations can be added but not removed
• Labels can be added but not removed

In summary, a locked policy can be increased or extended, but it can't be reduced or turned off.

Reference: Use Preservation Lock to restrict changes to retention policies and retention label policies

Explanation:

When content has retention settings assigned to it, that content remains in its original location. Most of the time, people continue to work with their documents or mail as if nothing's changed. But if they edit or delete content that's included in the retention policy, a copy of the content is automatically retained.

• For SharePoint and OneDrive sites: The copy is retained in the Preservation Hold library.

• For Exchange mailboxes: The copy is retained in the Recoverable Items folder.

• For Teams, Viva Engage messages, and interactions with Microsoft Copilot for Microsoft 365: The copy is retained in a hidden folder named SubstrateHolds as a subfolder in the Exchange Recoverable Items folder.

These secure locations and the retained content aren't visible to most people. In most cases, people don't even need to know that their content is subject to retention settings.

Reference: Learn about retention policies and retention labels

Explanation:

In OneDrive or a SharePoint library, you can apply a retention label to a file, for example a Microsoft 365 document created in Word, PowerPoint, Excel, or a OneNote notebook. You can also label non-Office files, for example a PDF document or an image file. SharePointlist itemscan also be labeled.

You can also apply a label to a library or folder. When you label a library or folder, that retention label is applied by default to unlabeled files in that folder.

Both users (owner and member) can apply retention labels to all files in Site1. But, File3.docx has a read-only icon, which signals the file can't be modified.

References:

Publish retention labels and apply them in apps

Apply retention labels to files in SharePoint or OneDrive