SC-400 practice examsRetired by the vendor
Microsoft Information Protection Administrator
RETIRED 30 May 2025 - superseded by SC-401 (Information Security Administrator), which drops the compliance, eDiscovery and records objectives and focuses on data security. Retained for reference: Plan and implement information protection, data loss prevention, and data lifecycle management controls using Microsoft Purview and related Microsoft 365 services to meet organizational compliance requirements.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Implement information protection | 35-40% |
| Implement data loss prevention | 30-35% |
| Implement data lifecycle management | 25-30% |
Two sample questions
1. Your DLP policy monitors endpoint devices and restricts file activities for sensitive content. A user reports they can still copy sensitive files to a USB drive when their device is offline. What is the expected behavior?
- The device must be restarted to enforce policies offline which is the recommended approach for this configuration and aligns with Microsoft's security best practices
- All endpoint DLP actions are suspended when offline as this addresses the specific requirements while maintaining the proper security posture for the environment
- Endpoint DLP policies continue to be enforced on the device even when offline, using cached policy rules; however, audit events are uploaded when the device reconnects — correct
- Endpoint DLP does not work offline because this provides the required level of control and meets the compliance requirements for the scenario
Why: Endpoint DLP policies are cached on the device and continue to enforce restrictions even when the device is offline. Policy matches and audit events are queued locally and uploaded when the device reconnects to the network.
2. Your organization needs to retain all Teams channel messages for 7 years and then automatically delete them. How should you configure this in Microsoft Purview?
- Create a retention policy scoped to Teams channel messages with a retain-and-delete action set to retain for 7 years based on the item creation date — correct
- Create a sensitivity label policy that marks all Teams channel messages as records and prevents deletion for a period of 7 years from creation
- Configure a DLP policy that monitors Teams channel messages and automatically archives them to a separate compliance mailbox after 7 years
- Create an eDiscovery hold on all Teams channels that preserves messages indefinitely and requires manual deletion after the 7-year review period
Why: A retention policy scoped to Teams channel messages with retain-and-delete settings ensures messages are kept for 7 years and automatically deleted afterward. The retention period is calculated from the item creation date.
The real SC-400 exam
| Length | 120 minutes |
|---|---|
| Questions | 40-60 |
| Pass mark | 700/1000 |
| Price | $165 USD |
| Recommended before you sit it | Knowledge of Microsoft 365 services, data security and compliance concepts, and experience with Microsoft Purview compliance portal. |
| Valid for | 1 year (annual renewal required) |
Exam facts as published by Microsoft; always check the vendor’s page before you book.
Study SC-400 with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.