AzureAssociate

Microsoft Certified: Information Security Administrator Associate

SC-401

Plan and implement information protection, data loss prevention, retention and insider-risk controls with Microsoft Purview.

Duration
100 min
Exam questions
40–60
Passing score
700 / 1000
Exam fee
$165
Question formats:Multiple choiceMultiple responseYes / NoYes / No statementsDrag and dropHot areacase study
Free plan
3 free papers
Free account
Mocks locked
Pro only
Upgrade to Pro
Every paper and mock exam.
See Pro

Start with free papers Free

You get 3 free practice papers with your plan.

Free
Mixed paper 1
Domain 1 · 25 questions
Free
Mixed paper 2
Domain 1 · 25 questions
Free
Mixed paper 3
Domain 1 · 25 questions
Pro
Case study: Halvorsk Legal
6 questions · 10 min
Pro
Case study: Denmoor Credit Union
6 questions · 10 min

Domain papers 512 questions

Free
Mixed paper 1
25 questions · 60 min
Free
Mixed paper 2
25 questions · 60 min
Free
Mixed paper 3
25 questions · 60 min
Pro
Mixed paper 4
25 questions · 60 min
Pro
Mixed paper 5
25 questions · 60 min
Pro
Mixed paper 6
25 questions · 60 min
Pro
Mixed paper 7
10 questions · 24 min

Mock exams Pro

Full-length, exam-like practice tests. Available with Pro.

Mock exam 1
50 questions · 100 min
Mock exam 2
50 questions · 100 min
Mock exam 3
50 questions · 100 min

Try a sample question

All 10 sample questions →
Question 1Implement information protection

Woodgrove Bank must detect only the account numbers that belong to its 180,000 real customers, and no other numbers of the same shape. You decide to build an exact data match based sensitive information type. Which two tasks must you complete before the exact data match type can return matches? Each correct answer presents part of the solution. (Choose TWO.)

Choose 2.

  1. A.

    Create a custom trainable classifier that is trained on a sample of the account number table.

  2. B.

    Hash and upload the sensitive information source table by using the EDM Upload Agent, signed in with an account in the EDM_DataUploaders security group.

  3. C.

    Enable optical character recognition for the tenant so that account numbers in images are read.

  4. D.

    Define the exact data match schema, which maps the columns of the sensitive information source table and identifies the primary fields that can start a lookup.

  5. E.

    Publish an auto-labeling policy in simulation mode that references the exact data match type.

Show answer

Answer: B, D

An exact data match type needs a schema that declares which columns are searchable and a hashed, uploaded copy of the sensitive data table before it can match anything.

  • A. Trainable classifiers learn a fuzzy content category and are never part of the exact data match build process.
  • B. The EDM Upload Agent hashes the table with a salt and uploads only the hashes; the uploading account must belong to the EDM_DataUploaders group, and without an uploaded, indexed table there is nothing to compare content against.
  • C. Optical character recognition only extends scanning into images and is not a prerequisite for exact data match detection.
  • D. The schema maps the source table's columns and marks which fields are primary (searchable); in the new experience it is generated from a sample file in the same workflow that creates the SIT, but it must exist before anything can match.
  • E. Simulation mode is how you test a policy that consumes the classifier; it does nothing to make the exact data match type functional.

What's on the exam

3 domains · 9 task statements, straight from the official exam guide (as of October 28, 2026).

  1. 1.1Implement and manage data classification
    • Identify sensitive information requirements for an organization's data
    • Translate sensitive information requirements into built-in or custom sensitive info types
    • Create and manage custom sensitive info types
    • Implement document fingerprinting
    • Create and manage exact data match based sensitive information types (EDM)
    • Create and manage trainable classifiers
    • Monitor data classification and label usage by using Data explorer and Content explorer
    • Configure optical character recognition (OCR) support for sensitive info types
  2. 1.2Implement and manage sensitivity labels in Microsoft Purview
    • Implement roles and permissions for administering sensitivity labels
    • Define and create sensitivity labels for items and containers
    • Configure protection settings and content marking for sensitivity labels
    • Configure and manage publishing policies for sensitivity labels
    • Configure and manage auto-labeling policies for sensitivity labels
    • Apply sensitivity labels to containers, such as Microsoft Teams, Microsoft 365 Groups, and Microsoft SharePoint sites, and to Power BI items
    • Apply sensitivity labels by using Microsoft Defender for Cloud Apps
  3. 1.3Implement information protection for Windows, file shares, and Exchange
    • Plan and implement the Microsoft Purview Information Protection client
    • Manage files by using the Microsoft Purview Information Protection client
    • Apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner
    • Design and implement Microsoft Purview Message Encryption
    • Design and implement Microsoft Purview Advanced Message Encryption

Outline reproduced from the vendor's public exam guide for study reference.Official guide

SC-401 practice — frequently asked questions

Are these real SC-401 exam questions?

No. Every question on CertifyCloudx is original, written by us against Microsoft Azure's publicly available SC-401 exam guide to rehearse the skills it lists. None are actual exam questions, and CertifyCloudx is not affiliated with or endorsed by Microsoft Azure.

How many SC-401 practice questions are there?

512 practice questions, including 3 full-length timed mock exams and 46 domain papers of up to 25 questions (mixed and by topic). Every question has a detailed explanation of why the right answer wins and why each distractor loses.

Is the content up to date with the current SC-401 exam guide?

The questions are written against the SC-401 exam guide dated October 28, 2026, and we revise them when Microsoft Azure updates the guide.

What question formats are covered?

The same formats the real SC-401 uses: Multiple choice, Multiple response, Yes / No, Yes / No statements, Drag and drop, Hot area, case study. Each is rendered and graded the way the exam does it.

How long is the SC-401 exam and how many questions does it have?

According to Microsoft Azure's published exam details: 40–60 questions, 100 minutes, passing score 700 / 1000. Our mock exams use the same time limit, with a question count in the middle of that range. Always confirm current details with Microsoft Azure before booking.

Can I practise SC-401 for free?

Yes. 3 papers are free, with up to 10 questions a day on the free plan and no card needed. Pro unlocks every paper and mock exam with no daily limit.

Does CertifyCloudx guarantee that I will pass?

No practice material can guarantee a result. CertifyCloudx helps you find and close your weak areas — accuracy by exam-guide domain and topic shows what to study next.