Administering Information Security in Microsoft 365 (SC-401) Practice Tests

Explanation

Endpoint DLP policies must be applied to Devices to monitor and protect data on onboarded Windows 10, Windows 11, and macOS devices. Applying the policy to devices enables monitoring of local file activities, USB transfers, clipboard operations, and other endpoint-specific data movement scenarios. Exchange email applies policies to email messages and mailboxes. OneDrive accounts targets cloud storage protection. On-premises repositories applies to file shares and on-premises SharePoint servers. Only applying to Devices creates a true endpoint DLP policy.

Explanation

No, this solution does not meet the goal. Trainable classifiers require a minimum of 50 files per site, and you only provided 45 files. This falls below the required threshold, so the classifier cannot be properly trained. The requirement is between 50 and 500 files per site. While you're close to the minimum, Microsoft's system will not process samples below this threshold.

Explanation

No, this solution does not meet the goal because Audit (Standard) only supports the default 180-day retention period and cannot be configured for extended retention. To maintain logs for 5 years, the organization must upgrade to Audit (Premium) with the appropriate licensing, which allows configurable retention policies up to 10 years. Audit (Standard) lacks the retention policy configuration capabilities needed for this requirement.

Explanation

Communication Compliance is designed to detect and flag risky content for human review by compliance officers, not to automatically block prompts before they reach Copilot. The blocking functionality is not part of Communication Compliance's capabilities. While Communication Compliance can identify riskant language in prompts and responses, it presents these to reviewers on the Pending tab for investigation and action. The automatic blocking action described in the solution is not what Communication Compliance provides. To prevent prompts from reaching Copilot, organizations would need to use DLP policies instead.

Explanation

Setting confidence level to low will create excessive false positives because low confidence means the system will flag items with minimal supporting evidence. To reliably detect credit card leaks while minimizing false positives, you should set medium or high confidence levels. High confidence requires supporting elements like expiration dates or CVV codes to be detected alongside the credit card number, which significantly reduces false positives while maintaining detection accuracy. Low confidence would flag any string that resembles a credit card number, leading to alert fatigue and reduced effectiveness.