Pass the Microsoft Microsoft Certified: Information Security Administrator Associate SC-401 Questions and answers with CertsForce

You have a Microsoft SharePoint Online site named Site! that contains the files shown in the following table.

You have a data loss prevention (DLP) policy named DLP1 that has the advanced DLP rules shown in the following table.

You apply DLP1 toSite1.

Which policy tips will appear for File2?

You implement Microsoft 365 Endpoint data loss prevention (Endpoint DIP).

You have computers that run Windows 11 and have Microsoft 365 Apps instated. The computers are joined to a Microsoft Entra tenant

You need to ensure that Endpoint DIP policies can protect content on the computers.

Solution: You deploy the Endpoint DLP configuration package to the computers.

Does this meet the goal?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft 365 subscription.

You have a user named User1. Several users have full access to the mailbox of User1.

Some email messages sent to User1 appear to have been read and deleted before the user viewed them.

When you search the audit log in the Microsoft Purview portal to identify who signed in to the mailbox of User1, the results are blank.

You need to ensure that you can view future sign-ins to the mailbox of User1.

Solution: You run the Set-AdminAuditLogConfig -AdminAuditLogEnabled $true -AdminAuditLogCmdlets *Mailbox* command.

Does that meet the goal?

You have a Microsoft 36S ES subscription that contains two Windows devices named Devicel1and Device2 Device1 has the default browser set to Microsoft Edge. Devke2 has the default browser set to Google Chrome.

You need to ensure that Microsoft Purview insider risk management can collect signals when a user copies files to a USB device by using their default browser.

What should you deploy to each device? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft 36S ES subscription that contains a Windows 11 device named Device 1 and three users named User 1. User2. and User3.

You plan to deploy Azure Information Protection (AIP) and the Microsoft Purview Information Protection client to Device 1.

You need to ensure that the users can perform the following actions on Device1 as part of the planned deployment

• User 1 will test the functionality of the client.

• User2 will install and configure the Microsoft Rights Management connector.

• User3 will be configured as the service account for the information protection scanner.

The solution must maximize the security of the sign-in process for the users What should you do?

HOTSPOT

You have a Microsoft 365 E5 subscription that contains two users named User1 and User2.

You create the audit retention policies shown in the following table.

The users perform the following actions:

● User1 renames a Microsoft SharePoint Online site.

● User2 sends an email message.

How long will the audit log records be retained for each action? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft 36S ES subscription.

You plan to use the Microsoft Purview portal to map human resources (HR) data for use with insider risk management policies.

You need to add a data connector to import the HR data.

What should you do first and in which format should you import the data? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription that contains the devices shown in the following table.

From which devices can Microsoft Purview Insider Risk Management capture forensic evidence?

You need to meet the technical requirements for the creation of the sensitivity labels.

To which user or users must you assign the Sensitivity Label Administrator role?

HOTSPOT

You need to meet the technical requirements for the confidential documents.

What should you create first, and what should you use for the detection method? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.