In the full course
What you get
- 400 exam-style questions, each with a full explanation
- 20 performance-based tasks, marked with partial credit
- 200 flashcards, filtered by domain
- The full study guide, 26 chapters
- Timed mock exams matched to the real exam length
- A readiness score weighted by the official exam blueprint
Get full access to Microsoft SC-401
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
Lifetime · all courses
$29.99
One payment · future courses included
30 seconds, then straight to checkout.
Pass, or your money back
Reach 85% readiness on this course, sit the real exam, and if you don't pass we refund it in full. Applies to this single-course purchase. Terms.
More free samples
Marked, and passed
Real feedback from people who passed
“I failed my CISSP on the first attempt with another platform. Switched to CertCrush, focused on my weak domains using the tracking feature, and passed three months later. The explanations for wrong answers are genuinely useful, not just 'A is correct because A is correct'.”
“Honestly wasn't expecting much but this is probably the best ten bucks I've spent on exam prep. Did 20–30 questions every morning before work for 6 weeks. Passed with a comfortable margin. The timed exam mode is what really got me comfortable with the pressure.”
“The flashcards are underrated. I used them during my commute and it made a huge difference for the theory-heavy ITIL questions. Passed first try. Already using it again for CISM.”
SC-401 is Microsoft's associate certification for administrators who protect sensitive data with Microsoft Purview. It replaced SC-400 in May 2025 and covers data classification, sensitivity labels, data loss prevention, retention, insider risk management, and the newer controls that govern data reachable by AI services. This course works the published blueprint objective by objective.
Practice content last updated · Independently written and aligned to Microsoft’s published exam objectives.
About the Microsoft SC-401 Exam
Exam SC-401, Administering Information Security in Microsoft 365, earns the Microsoft Certified: Information Security Administrator Associate credential. It replaced SC-400 when that exam retired on 31 May 2025, and the scope moved with it. SC-401 keeps the classification, labelling and DLP ground, then adds insider risk management, Purview Audit, eDiscovery search, and a full set of objectives on protecting data that AI services can reach, including Data Security Posture Management for AI. The three skill areas are weighted almost evenly, each at 30 to 35 percent. That changes how you revise, because there is no small domain to skip. A candidate who knows sensitivity labels cold but has never selected an insider risk policy template or filtered Activity explorer loses a third of the exam on questions they never prepared for. Almost all of it lives in one portal. If you can open Microsoft Purview and say what happens when a retention label and a retention policy disagree, which DLP rule wins when two policies match the same file, what has to be configured before forensic evidence capture records anything, and which prerequisites DSPM for AI needs before its policies do any work, you are close to ready. If those read as feature names rather than settings you have changed, start at the classification objectives and work forward. The exam runs 100 minutes and is scored out of 1000, with 700 required to pass. Microsoft says it may contain interactive components, so drag and drop, build list and active screen items appear alongside multiple choice.
Exam Domains Covered
- Implement information protection34%
- Implement data loss prevention and retention33%
- Manage risks, alerts, and activities33%
Exam Format & Details
100 minutes, proctored at a Pearson VUE test centre or online through OnVUE. Scored on a scale of 1000 with 700 required to pass, which the CertCrush practice exams express as 70 percent. Microsoft does not publish a fixed question count for SC-401; its own guidance is that most certification exams carry between 40 and 60 questions. Microsoft states that the exam may include interactive components, so expect drag and drop, build list and active screen items alongside multiple choice. The US list price is 165 USD; Microsoft prices the exam by the country or region it is proctored in, so check the Pearson VUE booking page for your local fee. Microsoft Learn is available inside the exam window for associate exams, with no extra time added. The certification expires after one year and is renewed free by passing an online assessment on Microsoft Learn.
Why Practice Questions Matter
SC-401 asks what a setting does, not what a term means. Purview is full of features that read alike and behave differently: retention labels against retention policies, DLP policy precedence, auto-labelling against the Information Protection client, adaptive scopes against static ones. Reading the documentation once leaves those blurred together. Answering questions forces you to commit to one option and then read why the other three fail, which is where the boundaries become visible. Practising domain by domain also exposes the objective you have been quietly avoiding, and on an exam split three ways at roughly a third each, a weak domain has nowhere to hide.
Try 2 performance tasks free
Drag-and-drop, sequencing and configuration tasks that mirror the interactive questions on the real Microsoft SC-401 exam, marked with partial credit.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft SC-401 exam, not actual exam content.
Q1.An administrator is about to run an audit log search and wants to avoid a result set of tens of thousands of rows that has to be sorted through afterward. What is the recommended first step?
- A.Leave the Activities field blank so nothing is filtered out
- B.Skip naming the search, since results are timestamped automatically
- C.Start with a narrow date and time range, such as a single day rather than a quarter
- D.Export the full unfiltered log first, then filter the exported comma-separated values file afterward
Domain: Manage risks, alerts, and activities
Q2.Contoso has a default policy giving SharePoint records one year of retention. An administrator later adds Policy C, priority 500, covering all record types for all users with a six-month duration. No other custom policy covers SharePoint. What happens to SharePoint record retention as a result?
- A.It shortens to six months, because Policy C beats the default policy even though it is broad and low priority
- B.It stays at one year, because Policy C only applies to record types and users not already covered by the existing default retention policy
- C.It lengthens to Policy C's priority value of 500 days
- D.It has no effect, because the default policy always overrides any policy at priority 500 or lower
Domain: Manage risks, alerts, and activities
Q3.Where in the Microsoft Purview portal does an administrator run a current, non-retired audit log search?
- A.Solutions > Data Loss Prevention > Alerts
- B.Solutions > Insider Risk Management > Alerts
- C.Solutions > Audit > Search
- D.Solutions > eDiscovery > Cases
Domain: Manage risks, alerts, and activities
Q4.Which role can manage Data Loss Prevention policies, and which broader role group covers DLP alongside the other data security solutions together?
- A.Security Administrator can manage DLP, and Information Protection Admins covers the data security solutions together
- B.Global Reader can manage DLP, and Compliance Data Administrator covers the broader data security solutions together
- C.Reports Reader can manage DLP, and Security Reader covers the broader data security solutions together
- D.Compliance Administrator can manage DLP, and Data Security Management covers the broader data security solutions together
Domain: Implement data loss prevention and retention
Q5.An administrator activates several DSPM for AI recommended policies and checks the dashboard an hour later, finding almost no data. What is the most likely explanation, and what should the administrator do?
- A.Reassign the Compliance Administrator role, since view-only roles cannot populate the dashboard for anyone.
- B.Delete and recreate every one-click policy, since a stale policy state blocks new data from ever appearing.
- C.Switch from audit mode to enforce mode immediately, since audit mode never generates any report data at all.
- D.Wait at least 24 hours before judging the dashboard results, since DSPM for AI aggregates rather than queries live
Domain: Manage risks, alerts, and activities
Q6.What are the four stages of the Insider Risk Management workflow, in order?
- A.Alert, policy, resolution, case
- B.Policy, alert, case, action
- C.Connector, indicator, threshold, escalation
- D.Trigger, indicator, severity, notice
Domain: Manage risks, alerts, and activities
Q7.Which of these settings does a container label control? (Choose THREE.)
- A.Privacy, meaning whether the group or site is public or private
- B.External sharing from the labelled SharePoint site
- C.Access from unmanaged devices, through Microsoft Entra Conditional Access
- D.File encryption for every document stored inside the container
- E.Content marking such as headers, footers and watermarks on documents inside the container
- F.The retention period applied to items inside the container
Domain: Implement information protection
Q8.Which named individual role lets someone create and configure sensitivity labels without being added to a broader compliance role group?
- A.Compliance Administrator, which grants the same label-creation rights plus a much wider set of unrelated compliance permissions
- B.Sensitivity Label Reader
- C.Sensitivity Label Administrator
- D.Information Protection Readers
Domain: Implement information protection
Q9.Where in the Microsoft Purview portal would an administrator go to search the full list of built-in sensitive information types?
- A.Solutions, Data Loss Prevention, Policies
- B.Solutions, Information Protection, Classifiers, Sensitive info types
- C.Solutions, Records Management, Retention labels, label policies and retention policies
- D.Solutions, eDiscovery, Cases
Domain: Implement information protection
Q10.An administrator wants to classify a backlog of documents and report on volume before committing to any destruction rule. Which retention label setting achieves that without retaining or deleting anything?
- A.Retain items for a specific period and then start a disposition review before deleting anything.
- B.Enforce a delete action after a specific period without retaining the content first.
- C.Label items with no retention action, so the label only marks the content.
- D.Retain items forever, since nothing can be deleted once any label is applied.
Domain: Implement data loss prevention and retention
Microsoft SC-401 guides & exam news
SC-400 Is Retired: What Replaces It in 2026, and Is SC-401 the Same Exam?
Microsoft retired the SC-400 exam and the Information Protection and Compliance Administrator certification on 30 May 2025. SC-401 replaced it, but it is not a renumbering. Here is what changed, what your old notes are still worth, and what happens to the badge you hold.
How to Pass the Microsoft SC-401 Exam in 2026: An 8-Week Study Plan for the New Information Security Administrator Certification
SC-401 replaced the retired SC-400 and is now Microsoft's information security admin exam. This 8-week study plan breaks down the three Purview-heavy domains, the exam format and exactly what to revise each week so you pass first time.
SC-500 vs SC-200 in 2026: Which Microsoft Security Exam Should You Take?
SC-500 is for engineers who build and harden Azure, hybrid and AI workloads. SC-200 is for analysts who detect, investigate and respond. How the two 2026 exams differ, where their objectives overlap, and which to take first.
Microsoft AB-650 Exam Topics and Domain Weightings in 2026: The MS-102 Replacement, Now in Beta
AB-650 replaces MS-102 as Microsoft's tenant administration exam, and the weightings tell a different story. Security and governance take 40 to 45 percent, AI services take 35 to 40 percent, and classic tenant admin is down to a fifth of the exam.
Frequently Asked Questions
Does the Microsoft SC-401 course include performance-based questions?
Yes. The Microsoft SC-401 course includes 20 performance-based questions (PBQs): hands-on tasks that mirror the interactive questions on the real exam, including drag-and-drop matching, sequencing and configuration screens. Each one is marked with partial credit, so you can see exactly which placements were wrong, and every task includes a full explanation. The first two are free to try.
What is included in the free Microsoft SC-401 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft SC-401 course?
The full Microsoft SC-401 course includes 400 practice questions and 20 performance-based tasks, covering all 3 exam domains. Every question carries a full explanation for the right answer and the wrong ones.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned. They mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft SC-401 course cover?
The course covers 3 exam domains: Implement information protection, Implement data loss prevention and retention, Manage risks, alerts, and activities.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.
Start with 10 free questions
No account, no card. The full Microsoft SC-401 course is $9.99, once.