Microsoft
Free Microsoft SC-401 Practice Questions
The Microsoft SC-401 exam is up to 50 questions in 100 minutes, and the voucher costs $165. CertCrush provides 400 syllabus-aligned practice questions and 20 performance-based questions across all 3 exam domains, each with a full explanation. Free to try, no account required.
SC-401 is Microsoft's associate certification for administrators who protect sensitive data with Microsoft Purview. It replaced SC-400 in May 2025 and covers data classification, sensitivity labels, data loss prevention, retention, insider risk management, and the newer controls that govern data reachable by AI services. This course works the published blueprint objective by objective.
Practice content last updated · Independently written and aligned to Microsoft’s published exam objectives.
10
Sample questions
100 min
Exam time limit
70%
Practice pass mark
$165
Exam voucher
About the Microsoft SC-401 Exam
Exam SC-401, Administering Information Security in Microsoft 365, earns the Microsoft Certified: Information Security Administrator Associate credential. It replaced SC-400 when that exam retired on 31 May 2025, and the scope moved with it. SC-401 keeps the classification, labelling and DLP ground, then adds insider risk management, Purview Audit, eDiscovery search, and a full set of objectives on protecting data that AI services can reach, including Data Security Posture Management for AI. The three skill areas are weighted almost evenly, each at 30 to 35 percent. That changes how you revise, because there is no small domain to skip. A candidate who knows sensitivity labels cold but has never selected an insider risk policy template or filtered Activity explorer loses a third of the exam on questions they never prepared for. Almost all of it lives in one portal. If you can open Microsoft Purview and say what happens when a retention label and a retention policy disagree, which DLP rule wins when two policies match the same file, what has to be configured before forensic evidence capture records anything, and which prerequisites DSPM for AI needs before its policies do any work, you are close to ready. If those read as feature names rather than settings you have changed, start at the classification objectives and work forward. The exam runs 100 minutes and is scored out of 1000, with 700 required to pass. Microsoft says it may contain interactive components, so drag and drop, build list and active screen items appear alongside multiple choice.
Exam Domains Covered
Exam Format & Details
100 minutes, proctored at a Pearson VUE test centre or online through OnVUE. Scored on a scale of 1000 with 700 required to pass, which the CertCrush practice exams express as 70 percent. Microsoft does not publish a fixed question count for SC-401; its own guidance is that most certification exams carry between 40 and 60 questions. Microsoft states that the exam may include interactive components, so expect drag and drop, build list and active screen items alongside multiple choice. The US list price is 165 USD; Microsoft prices the exam by the country or region it is proctored in, so check the Pearson VUE booking page for your local fee. Microsoft Learn is available inside the exam window for associate exams, with no extra time added. The certification expires after one year and is renewed free by passing an online assessment on Microsoft Learn.
Why Practice Questions Matter
SC-401 asks what a setting does, not what a term means. Purview is full of features that read alike and behave differently: retention labels against retention policies, DLP policy precedence, auto-labelling against the Information Protection client, adaptive scopes against static ones. Reading the documentation once leaves those blurred together. Answering questions forces you to commit to one option and then read why the other three fail, which is where the boundaries become visible. Practising domain by domain also exposes the objective you have been quietly avoiding, and on an exam split three ways at roughly a third each, a weak domain has nowhere to hide.
Try Microsoft SC-401
Try 10 questions now. No account, no card.
A free account unlocks 25 questions per course plus readiness tracking.
Get full access to Microsoft SC-401
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
Lifetime · all courses
$29.99
One payment · future courses included
30 seconds, then straight to checkout.
Pass, or your money back
Reach 85% readiness on this course, sit the real exam, and if you don't pass we refund it in full. Applies to this single-course purchase. Terms.
Try 2 performance tasks free
Drag-and-drop, sequencing and configuration tasks that mirror the interactive questions on the real Microsoft SC-401 exam, marked with partial credit.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft SC-401 exam, not actual exam content.
Q1.When resolving an insider risk case, which two classifications can an investigator choose from the Resolve as dropdown?
- A.Needs review or Resolved
- B.Low, Medium or High severity, matching the alert's original calculated rating
- C.Benign or Confirmed policy violation
- D.Dismissed or Escalated
Domain: Manage risks, alerts, and activities
Q2.Which Purview capability lets a rule scoped to Exchange Online, Teams and Devices use the condition Insider risk level for Adaptive Protection is?
- A.Communication compliance
- B.eDiscovery
- C.Retention labels
- D.Data loss prevention policies
Domain: Manage risks, alerts, and activities
Q3.A user downloads 10 files from a SharePoint site in one day and all 10 are scored high severity. Under the built-in Elevated level definition, how many high severity insights does that single day of activity contribute?
- A.Zero insights, because a single calendar day of activity never counts toward any level
- B.Three insights, matching the Elevated threshold exactly
- C.Ten separate insights, one for each file downloaded
- D.One insight, because the ten events aggregate into a single insight
Domain: Manage risks, alerts, and activities
Q4.Under Insider Risk Management in the Microsoft Purview portal, which pages can an Insider Risk Management Analyst work with day to day?
- A.Only the insider risk audit logs
- B.Alerts, cases and notice templates
- C.Policies, global settings and role group assignments
- D.Forensic evidence and Content Explorer only
Domain: Manage risks, alerts, and activities
Q5.Where in the Microsoft Purview portal does an administrator run a current, non-retired audit log search?
- A.Solutions > Data Loss Prevention > Alerts
- B.Solutions > Insider Risk Management > Alerts
- C.Solutions > Audit > Search
- D.Solutions > eDiscovery > Cases
Domain: Manage risks, alerts, and activities
Q6.In a sensitive information type's pattern, what is the primary element?
- A.The corroborating keyword that must appear near the main match
- B.The numeric score assigned once a match is found
- C.The main thing the pattern searches for, such as a regular expression or keyword list
- D.The character distance between the primary element and a nearby supporting keyword
Domain: Implement information protection
Q7.Character proximity in a sensitive information type pattern is measured in which unit?
- A.Character distance
- B.Words
- C.Lines of text
- D.Paragraphs
Domain: Implement information protection
Q8.Where in the Microsoft Purview portal would an administrator go to search the full list of built-in sensitive information types?
- A.Solutions, Data Loss Prevention, Policies
- B.Solutions, Information Protection, Classifiers, Sensitive info types
- C.Solutions, Records Management, Retention labels, label policies and retention policies
- D.Solutions, eDiscovery, Cases
Domain: Implement information protection
Q9.When a blank template is uploaded to create a document fingerprint, what happens to the original file?
- A.It is stored encrypted alongside the hash for future reference by a compliance administrator
- B.It is uploaded to the sensitive information source table
- C.It is retained for 24 hours, then automatically deleted
- D.It is never stored, and cannot be reconstructed from the resulting hash
Domain: Implement information protection
Q10.In the underlying numeric values Purview assigns to confidence levels, which value corresponds to medium confidence?
- A.55
- B.65
- C.85
- D.75 points
Domain: Implement information protection
Microsoft SC-401 guides & exam news
SC-400 Is Retired: What Replaces It in 2026, and Is SC-401 the Same Exam?
Microsoft retired the SC-400 exam and the Information Protection and Compliance Administrator certification on 30 May 2025. SC-401 replaced it, but it is not a renumbering. Here is what changed, what your old notes are still worth, and what happens to the badge you hold.
How to Pass the Microsoft SC-401 Exam in 2026: An 8-Week Study Plan for the New Information Security Administrator Certification
SC-401 replaced the retired SC-400 and is now Microsoft's information security admin exam. This 8-week study plan breaks down the three Purview-heavy domains, the exam format and exactly what to revise each week so you pass first time.
Microsoft AB-650 Exam Topics and Domain Weightings in 2026: The MS-102 Replacement, Now in Beta
AB-650 replaces MS-102 as Microsoft's tenant administration exam, and the weightings tell a different story. Security and governance take 40 to 45 percent, AI services take 35 to 40 percent, and classic tenant admin is down to a fifth of the exam.
PL-900 Exam Changes in 2026: New Copilot Studio Topics, Cost and Is It Still Worth It?
Microsoft rewrote the PL-900 exam on 24 July 2026. Power Pages is gone, a Copilot Studio agents domain worth 20 to 25 percent replaced it, and most study material still teaches the old outline. Here is what changed and whether the exam is still worth booking.
Frequently Asked Questions
Does the Microsoft SC-401 course include performance-based questions?
Yes. The Microsoft SC-401 course includes 20 performance-based questions (PBQs): hands-on tasks that mirror the interactive questions on the real exam, including drag-and-drop matching, sequencing and configuration screens. Each one is marked with partial credit, so you can see exactly which placements were wrong, and every task includes a full explanation. The first two are free to try.
What is included in the free Microsoft SC-401 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft SC-401 course?
The full Microsoft SC-401 course includes 400 practice questions and 20 performance-based tasks, covering all 3 exam domains. Every question carries a full explanation for the right answer and the wrong ones.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned. They mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft SC-401 course cover?
The course covers 3 exam domains: Implement information protection, Implement data loss prevention and retention, Manage risks, alerts, and activities.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.