Administering Information Security in Microsoft 365 (SC-401) — Practice Questions and Mock Exam

Exact Data Match (EDM) sensitive information types compare content against a hashed table of real sensitive values, delivering near-zero false positives. The workflow requires defining the EDM schema first (column names and data types) before uploading the sensitive data table. The schema defines what fields exist (e.g., EmployeeName, SSN) and their data types, which the upload agent uses to parse and hash the source CSV. Without the schema, the system cannot interpret the uploaded data. A keyword dictionary (distractor) uses pattern matching, not exact value comparison. A trainable classifier uses ML on document samples, not structured data tables. Creating a DLP policy is a downstream step after the EDM SIT exists. Ref: learn.microsoft.com/purview/sit-create-edm-sit-unified-ux-workflow

Protecting documents with a specific sensitivity label regardless of content uses a DLP policy condition based on the sensitivity label rather than sensitive information types. Configure the DLP rule with condition: "Content contains sensitivity label: Highly Confidential." This triggers the policy whenever any document with that label is shared, regardless of what data the document contains. This approach protects the classification decision rather than the content — even if no sensitive information types are detected, the label itself triggers protection. Actions can include: block external sharing, block with override, require encryption, and notify. This complements content-based DLP rules — label-based rules protect based on human classification judgment, while SIT-based rules protect based on automated content detection. Exam tip: Sensitivity label as DLP condition = protect based on classification regardless of content; SIT condition = protect based on detected content — use both for comprehensive protection.

Data explorer is tightly controlled because it can expose the content of classified files. Access to the data explorer tab comes from roles such as Compliance administrator or Compliance data administrator, and that membership alone does not show the list of items or their contents. Two separate role groups grant data access: Data Explorer List viewer for items and their locations, and Data Explorer Content viewer for item contents. They are independent and not cumulative, so you grant List viewer for locations and add Content viewer only if contents must be visible. Some broader role groups also carry these roles; for example, the Information Protection role group includes both the list viewer and the content viewer roles, so it would expose contents. Note that the content viewer role is also needed to see item names in list view. Exam tip: tab access, list access, and content access are separate grants, so check which roles a role group contains.