Try Microsoft SC-401
Try 10 questions now. No account, no card.
A free account unlocks 25 questions per course plus readiness tracking.
Get full access to Microsoft SC-401
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
Lifetime · all courses
$29.99
One payment · future courses included
30 seconds, then straight to checkout.
Pass, or your money back
Reach 85% readiness on this course, sit the real exam, and if you don't pass we refund it in full. Applies to this single-course purchase. Terms.
Microsoft · Exam reference
About the Microsoft SC-401 exam
SC-401 is Microsoft's associate certification for administrators who protect sensitive data with Microsoft Purview. It replaced SC-400 in May 2025 and covers data classification, sensitivity labels, data loss prevention, retention, insider risk management, and the newer controls that govern data reachable by AI services. This course works the published blueprint objective by objective.
10
Sample questions
100 min
Exam time limit
70%
Practice pass mark
$165
Exam voucher
Exam SC-401, Administering Information Security in Microsoft 365, earns the Microsoft Certified: Information Security Administrator Associate credential. It replaced SC-400 when that exam retired on 31 May 2025, and the scope moved with it. SC-401 keeps the classification, labelling and DLP ground, then adds insider risk management, Purview Audit, eDiscovery search, and a full set of objectives on protecting data that AI services can reach, including Data Security Posture Management for AI. The three skill areas are weighted almost evenly, each at 30 to 35 percent. That changes how you revise, because there is no small domain to skip. A candidate who knows sensitivity labels cold but has never selected an insider risk policy template or filtered Activity explorer loses a third of the exam on questions they never prepared for. Almost all of it lives in one portal. If you can open Microsoft Purview and say what happens when a retention label and a retention policy disagree, which DLP rule wins when two policies match the same file, what has to be configured before forensic evidence capture records anything, and which prerequisites DSPM for AI needs before its policies do any work, you are close to ready. If those read as feature names rather than settings you have changed, start at the classification objectives and work forward. The exam runs 100 minutes and is scored out of 1000, with 700 required to pass. Microsoft says it may contain interactive components, so drag and drop, build list and active screen items appear alongside multiple choice.
Exam Domains Covered
Exam Format & Details
100 minutes, proctored at a Pearson VUE test centre or online through OnVUE. Scored on a scale of 1000 with 700 required to pass, which the CertCrush practice exams express as 70 percent. Microsoft does not publish a fixed question count for SC-401; its own guidance is that most certification exams carry between 40 and 60 questions. Microsoft states that the exam may include interactive components, so expect drag and drop, build list and active screen items alongside multiple choice. The US list price is 165 USD; Microsoft prices the exam by the country or region it is proctored in, so check the Pearson VUE booking page for your local fee. Microsoft Learn is available inside the exam window for associate exams, with no extra time added. The certification expires after one year and is renewed free by passing an online assessment on Microsoft Learn.
Why Practice Questions Matter
SC-401 asks what a setting does, not what a term means. Purview is full of features that read alike and behave differently: retention labels against retention policies, DLP policy precedence, auto-labelling against the Information Protection client, adaptive scopes against static ones. Reading the documentation once leaves those blurred together. Answering questions forces you to commit to one option and then read why the other three fail, which is where the boundaries become visible. Practising domain by domain also exposes the objective you have been quietly avoiding, and on an exam split three ways at roughly a third each, a weak domain has nowhere to hide.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft SC-401 exam — not actual exam content.
Q1.An administrator is about to run an audit log search and wants to avoid a result set of tens of thousands of rows that has to be sorted through afterward. What is the recommended first step?
- A.Leave the Activities field blank so nothing is filtered out
- B.Skip naming the search, since results are timestamped automatically
- C.Start with a narrow date and time range, such as a single day rather than a quarter
- D.Export the full unfiltered log first, then filter the exported comma-separated values file afterward
Domain: Manage risks, alerts, and activities
Q2.Contoso has a default policy giving SharePoint records one year of retention. An administrator later adds Policy C, priority 500, covering all record types for all users with a six-month duration. No other custom policy covers SharePoint. What happens to SharePoint record retention as a result?
- A.It shortens to six months, because Policy C beats the default policy even though it is broad and low priority
- B.It stays at one year, because Policy C only applies to record types and users not already covered by the existing default retention policy
- C.It lengthens to Policy C's priority value of 500 days
- D.It has no effect, because the default policy always overrides any policy at priority 500 or lower
Domain: Manage risks, alerts, and activities
Q3.Where in the Microsoft Purview portal does an administrator run a current, non-retired audit log search?
- A.Solutions > Data Loss Prevention > Alerts
- B.Solutions > Insider Risk Management > Alerts
- C.Solutions > Audit > Search
- D.Solutions > eDiscovery > Cases
Domain: Manage risks, alerts, and activities
Q4.Which role can manage Data Loss Prevention policies, and which broader role group covers DLP alongside the other data security solutions together?
- A.Security Administrator can manage DLP, and Information Protection Admins covers the data security solutions together
- B.Global Reader can manage DLP, and Compliance Data Administrator covers the broader data security solutions together
- C.Reports Reader can manage DLP, and Security Reader covers the broader data security solutions together
- D.Compliance Administrator can manage DLP, and Data Security Management covers the broader data security solutions together
Domain: Implement data loss prevention and retention
Q5.An administrator activates several DSPM for AI recommended policies and checks the dashboard an hour later, finding almost no data. What is the most likely explanation, and what should the administrator do?
- A.Reassign the Compliance Administrator role, since view-only roles cannot populate the dashboard for anyone.
- B.Delete and recreate every one-click policy, since a stale policy state blocks new data from ever appearing.
- C.Switch from audit mode to enforce mode immediately, since audit mode never generates any report data at all.
- D.Wait at least 24 hours before judging the dashboard results, since DSPM for AI aggregates rather than queries live
Domain: Manage risks, alerts, and activities
Frequently Asked Questions
What is included in the free Microsoft SC-401 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft SC-401 course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the Microsoft SC-401 course page.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft SC-401 course cover?
The course covers 3 exam domains: Implement information protection, Implement data loss prevention and retention, Manage risks, alerts, and activities.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.