Microsoft · SC-401 · Associate
Administering Information Security in Microsoft 365 (SC-401) — Practice Questions and Mock Exam
Practice real SC-401 questions, never dumps. Alex explains every answer, and your readiness score tells you when you're ready to pass.
Checked against Microsoft · July 2026Current exam version
Overview
About the exam
The SC-401 certification validates skills in administering information security using Microsoft Purview and related Microsoft 365 services. It covers implementing data classification, sensitivity labels, data loss prevention (DLP) policies, information barriers, retention policies, records management, insider risk management, and eDiscovery solutions. This exam replaces the retired SC-400 with updated content reflecting current capabilities.
This certification is designed for information security administrators who protect sensitive data across Microsoft 365 collaboration environments. Candidates should have experience implementing data protection strategies using Microsoft Purview, including configuring DLP policies, sensitivity labels, retention, and compliance solutions for organizations subject to regulatory requirements.
Exam Domains
What's on the exam
The exam consists of 40–60 questions to be completed in approximately 100 minutes (100 minutes if labs are included). Question types include multiple-choice, multiple-select, drag-and-drop, and hot area formats. Questions are scenario-based, presenting data protection requirements and asking you to configure the appropriate Microsoft Purview solutions. Expect detailed questions about DLP rule configuration, sensitivity label policies, and insider risk indicators.
Implement and manage data classification, implement and manage sensitivity labels in Microsoft Purview, and implement information protection for Windows, file shares, and Exchange
Create and configure DLP policies, implement and monitor Microsoft Purview Endpoint DLP, and implement and manage retention
Implement and manage Microsoft Purview Insider Risk Management, manage information security alerts and activities, and protect data used by AI services
SourceMicrosoft study guide
Format
What to expect
Watch out
Where candidates struggle
This exam requires detailed knowledge of Microsoft Purview capabilities. Candidates with general Microsoft 365 administration experience who haven't deeply configured DLP policies, sensitivity labels, and compliance features often struggle with specifics.
- 01Sensitivity Labels — Not understanding sensitivity label priority, auto-labeling policies, and how labels interact across Exchange, SharePoint, and Teams.
- 02DLP Rule Logic — Confusing DLP policy conditions, exceptions, and actions across different Microsoft 365 locations and endpoint DLP scenarios.
- 03Insider Risk — Struggling with insider risk management policy templates, indicators, and the relationship between insider risk and communication compliance.
- 04Retention Policies — Overlooking how retention policies and retention labels interact, and the difference between static and adaptive scopes.
- 05eDiscovery Workflow — Not knowing the complete eDiscovery workflow including legal hold, content search, review sets, and export procedures in Purview.
Details
Exam logistics
Delivered via Pearson VUE online or at testing centers. Available in English. The certification is valid for 1 year with a free renewal assessment on Microsoft Learn. This exam replaced SC-400 in early 2025.
SourceMicrosoft exam page
Before you book the exam
Would you pass SC-401 today?
Take the free readiness check. Answer real SC-401 questions and get your readiness score across every domain.
Take the free readiness check20 questions · freeReach 80% readiness by exam day. Pass, or your money back.