100% Free SC-401 Practice Exam Questions (2026)

You have a Microsoft 565 subscription that contains 100 users and a Microsoft 365 group named Group1. All users have Windows 11 devices and use Microsoft SharePoint Online and Exchange Online. A sensitivity label named Label! is published as the default label for Group1. You add two sublabels named Sublabel1 and Sublabel2 lo Label1. You need to ensure that the settings in Sublabel 1 are applied by default to Group 1. What should you do?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You recently discovered that the developers at your company emailed Azure Storage Account keys in plain text to third parties. You need to ensure that when Azure Storage Account keys are emailed, the emails are encrypted. Solution: You configure a mail flow rule that matches the text patterns. Does this meet the goal? 

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 tenant and 500 computers that run Windows 11. The computers are onboarded to Microsoft Purview. You discover that a third-party application named Tailspin_scanner.exe accessed protected sensitive information on multiple computers. Tailspin_scanner.exe is installed locally on the computers. You need to block Tailspin_scanner.exe from accessing sensitive documents without preventing the application from accessing other documents. Solution: From the Microsoft Defender for Cloud Apps, you mark the application as Unsanctioned. Does this meet the goal?

Note: This question is part of a series of questions that present the same scenario. Each question inthe series contains a unique solution that might meet the stated goals. Some question sets mighthave more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, thesequestions will not appear in the review screen.You have a Microsoft 365 subscription.You have a user named User1. Several users have full access to the mailbox of User1.Some email messages sent to User1 appear to have been read and deleted before the user viewedthem.When you search the audit log in the Microsoft Purview portal to identify who signed in to themailbox of User1, the results are blank.You need to ensure that you can view future sign-ins to the mailbox of User1.Solution: You run the Set-AdminAuditLogConfig -AdminAuditLogEnabled $true -AdminAuditLogCmdlets *Mailbox* command.Does that meet the goal? 

You have a data loss prevention (DIP) policy that applies to the Devices location. The policy protects documents that contain United States passport numbers Users report that they cannot upload documents to a travel management website because of the pokey. Vou need to ensure that the users can upload the documents to the travel management website. The solution must prevent the protected content from being uploaded to other locations. Which Microsoft 365 Endpoint data loss prevention (Endpoint DIP) setting should you configure?