Administering Information Security in Microsoft 365 SC-401 Practice Test 2
Question 10
A custom bank-account detector matches random invoice line numbers when the pattern occurs without supporting text. During the pilot, an administrator instead implements this approach: Lower the minimum evidence threshold to match bare digits everywhere. The required outcome is not achieved. Which technical diagnosis BEST explains the failure?
- Retention duration does not change classification confidence
- Removing corroborating evidence increases rather than reduces false matches
- A filename extension does not validate the account-number pattern
- Additional evidence improves precision by requiring contextual confirmation around the numeric pattern
Explanation
Correct Answer
B:Removing corroborating evidence increases rather than reduces false matches. This identifies the failure of the specific pilot implementation.
Incorrect Answers
A:Retention duration does not change classification confidence. That limitation concerns a different competing approach, not this pilot change.
C:A filename extension does not validate the account-number pattern. This is a real constraint on a separate choice rather than the stated pilot implementation.
D:Additional evidence improves precision by requiring contextual confirmation around the numeric pattern. This describes the sound approach but does not diagnose why the observed alternative failed.
Question 11
A custom bank-account detector matches random invoice line numbers when the pattern occurs without supporting text. A change reviewer proposes Increase a retention policy period on invoice libraries instead of Add supporting keywords and appropriate proximity or confidence requirements to the custom sensitive information type. Which assessment BEST explains the proposed design gap?
- Removing corroborating evidence increases rather than reduces false matches
- A filename extension does not validate the account-number pattern
- Retention duration does not change classification confidence
- Additional evidence improves precision by requiring contextual confirmation around the numeric pattern
Explanation
Correct Answer
C:Retention duration does not change classification confidence. This deficiency directly applies to the suggested competing design.
Incorrect Answers
A:Removing corroborating evidence increases rather than reduces false matches. This limitation relates to a different rejected configuration.
B:A filename extension does not validate the account-number pattern. This explains a different option rather than the actual proposal.
D:Additional evidence improves precision by requiring contextual confirmation around the numeric pattern. This supports the preferred design rather than evaluating the proposed alternative.
Question 12
A custom bank-account detector matches random invoice line numbers when the pattern occurs without supporting text. After configuring the selected control, what acceptance evidence MOST DIRECTLY establishes that the stated boundary works?
- The detector definition appears in the policy list but no known-positive document was evaluated
- A sample file name includes the target term but the file contents were never classified
- Only one known-positive file was tried; no similarly formatted negative control was checked
- Test positive account documents and negative invoice numbers and compare classification confidence
Explanation
Correct Answer
D:Test positive account documents and negative invoice numbers and compare classification confidence. This observation verifies the required control: Add supporting keywords and appropriate proximity or confidence requirements to the custom sensitive information type. Additional evidence improves precision by requiring contextual confirmation around the numeric pattern.
Incorrect Answers
A:A saved detector does not establish that the intended sensitive sample is recognized. In the present case the decisive acceptance evidence is: Test positive account documents and negative invoice numbers and compare classification confidence
B:A filename clue does not verify sensitive information matching within document content. In the present case the decisive acceptance evidence is: Test positive account documents and negative invoice numbers and compare classification confidence
C:An isolated positive result cannot exclude the false positives the matching requirement must avoid. In the present case the decisive acceptance evidence is: Test positive account documents and negative invoice numbers and compare classification confidence
Question 13
A law firm maintains a controlled vocabulary of hundreds of sensitive case-code words that are updated each quarter. Which Microsoft Purview configuration or security administration decision BEST meets the requirement?
- Create a separate sensitivity label for each vocabulary word
- Use a custom sensitive information type with a managed keyword dictionary
- Use a single numeric regular expression to match the words
- Index the keywords solely in eDiscovery case notes
Explanation
Correct Answer
B:Keyword dictionaries handle large sets of related literal terms more maintainably than individually enumerated patterns. This choice directly addresses the stated protected-data workflow.
Incorrect Answers
A:Labels are protection categories, not a scalable synonym-matching dictionary. Consequently it cannot satisfy the stated requirement.
C:A numeric regex cannot detect the supplied textual case terms. Consequently it cannot satisfy the stated requirement.
D:Case notes do not create reusable sensitive information classification logic. Consequently it cannot satisfy the stated requirement.
Question 14
A law firm maintains a controlled vocabulary of hundreds of sensitive case-code words that are updated each quarter. During the pilot, an administrator instead implements this approach: Create a separate sensitivity label for each vocabulary word. The required outcome is not achieved. Which technical diagnosis BEST explains the failure?
- A numeric regex cannot detect the supplied textual case terms
- Case notes do not create reusable sensitive information classification logic
- Labels are protection categories, not a scalable synonym-matching dictionary
- Keyword dictionaries handle large sets of related literal terms more maintainably than individually enumerated patterns
Explanation
Correct Answer
C:Labels are protection categories, not a scalable synonym-matching dictionary. This identifies the failure of the specific pilot implementation.
Incorrect Answers
A:A numeric regex cannot detect the supplied textual case terms. That limitation concerns a different competing approach, not this pilot change.
B:Case notes do not create reusable sensitive information classification logic. This is a real constraint on a separate choice rather than the stated pilot implementation.
D:Keyword dictionaries handle large sets of related literal terms more maintainably than individually enumerated patterns. This describes the sound approach but does not diagnose why the observed alternative failed.
Question 15
A law firm maintains a controlled vocabulary of hundreds of sensitive case-code words that are updated each quarter. A change reviewer proposes Use a single numeric regular expression to match the words instead of Use a custom sensitive information type with a managed keyword dictionary. Which assessment BEST explains the proposed design gap?
- A numeric regex cannot detect the supplied textual case terms
- Labels are protection categories, not a scalable synonym-matching dictionary
- Case notes do not create reusable sensitive information classification logic
- Keyword dictionaries handle large sets of related literal terms more maintainably than individually enumerated patterns
Explanation
Correct Answer
A:A numeric regex cannot detect the supplied textual case terms. This deficiency directly applies to the suggested competing design.
Incorrect Answers
B:Labels are protection categories, not a scalable synonym-matching dictionary. This limitation relates to a different rejected configuration.
C:Case notes do not create reusable sensitive information classification logic. This explains a different option rather than the actual proposal.
D:Keyword dictionaries handle large sets of related literal terms more maintainably than individually enumerated patterns. This supports the preferred design rather than evaluating the proposed alternative.
Question 16
A law firm maintains a controlled vocabulary of hundreds of sensitive case-code words that are updated each quarter. After configuring the selected control, what acceptance evidence MOST DIRECTLY establishes that the stated boundary works?
- The detector definition appears in the policy list but no known-positive document was evaluated
- A sample file name includes the target term but the file contents were never classified
- Only one known-positive file was tried; no similarly formatted negative control was checked
- A newly added dictionary term matches a pilot file while a removed term no longer matches after propagation
Explanation
Correct Answer
D:A newly added dictionary term matches a pilot file while a removed term no longer matches after propagation. This observation verifies the required control: Use a custom sensitive information type with a managed keyword dictionary. Keyword dictionaries handle large sets of related literal terms more maintainably than individually enumerated patterns.
Incorrect Answers
A:A saved detector does not establish that the intended sensitive sample is recognized. In the present case the decisive acceptance evidence is: A newly added dictionary term matches a pilot file while a removed term no longer matches after propagation
B:A filename clue does not verify sensitive information matching within document content. In the present case the decisive acceptance evidence is: A newly added dictionary term matches a pilot file while a removed term no longer matches after propagation
C:An isolated positive result cannot exclude the false positives the matching requirement must avoid. In the present case the decisive acceptance evidence is: A newly added dictionary term matches a pilot file while a removed term no longer matches after propagation
Question 17
A financial institution wants to recognize completed versions of its standard loan application even when customers enter different names and amounts. Which Microsoft Purview configuration or security administration decision BEST meets the requirement?
- List every possible applicant name in an exact data match table
- Create a simple keyword rule for the word application
- Use a label policy that defaults every uploaded document to Confidential
- Create a document fingerprint based sensitive information type from the standard template
Explanation
Correct Answer
D:Document fingerprinting recognizes shared document structure while allowing populated fields to vary. This choice directly addresses the stated protected-data workflow.
Incorrect Answers
A:Applicant values do not identify the common document template structure. Consequently it cannot satisfy the stated requirement.
B:A generic keyword will match unrelated applications without the required structure. Consequently it cannot satisfy the stated requirement.
C:A default label does not distinguish the specific loan template. Consequently it cannot satisfy the stated requirement.
Question 18
A financial institution wants to recognize completed versions of its standard loan application even when customers enter different names and amounts. During the pilot, an administrator instead implements this approach: List every possible applicant name in an exact data match table. The required outcome is not achieved. Which technical diagnosis BEST explains the failure?
- A generic keyword will match unrelated applications without the required structure
- Applicant values do not identify the common document template structure
- A default label does not distinguish the specific loan template
- Document fingerprinting recognizes shared document structure while allowing populated fields to vary
Explanation
Correct Answer
B:Applicant values do not identify the common document template structure. This identifies the failure of the specific pilot implementation.
Incorrect Answers
A:A generic keyword will match unrelated applications without the required structure. That limitation concerns a different competing approach, not this pilot change.
C:A default label does not distinguish the specific loan template. This is a real constraint on a separate choice rather than the stated pilot implementation.
D:Document fingerprinting recognizes shared document structure while allowing populated fields to vary. This describes the sound approach but does not diagnose why the observed alternative failed.
Question 19
A financial institution wants to recognize completed versions of its standard loan application even when customers enter different names and amounts. A change reviewer proposes Create a simple keyword rule for the word application instead of Create a document fingerprint based sensitive information type from the standard template. Which assessment BEST explains the proposed design gap?
- Applicant values do not identify the common document template structure
- A default label does not distinguish the specific loan template
- A generic keyword will match unrelated applications without the required structure
- Document fingerprinting recognizes shared document structure while allowing populated fields to vary
Explanation
Correct Answer
C:A generic keyword will match unrelated applications without the required structure. This deficiency directly applies to the suggested competing design.
Incorrect Answers
A:Applicant values do not identify the common document template structure. This limitation relates to a different rejected configuration.
B:A default label does not distinguish the specific loan template. This explains a different option rather than the actual proposal.
D:Document fingerprinting recognizes shared document structure while allowing populated fields to vary. This supports the preferred design rather than evaluating the proposed alternative.
Question 20
A financial institution wants to recognize completed versions of its standard loan application even when customers enter different names and amounts. After configuring the selected control, what acceptance evidence MOST DIRECTLY establishes that the stated boundary works?
- Filled loan forms with different applicant values match while a similarly named unrelated form does not
- The detector definition appears in the policy list but no known-positive document was evaluated
- A sample file name includes the target term but the file contents were never classified
- Only one known-positive file was tried; no similarly formatted negative control was checked
Explanation
Correct Answer
A:Filled loan forms with different applicant values match while a similarly named unrelated form does not. This observation verifies the required control: Create a document fingerprint based sensitive information type from the standard template. Document fingerprinting recognizes shared document structure while allowing populated fields to vary.
Incorrect Answers
B:A saved detector does not establish that the intended sensitive sample is recognized. In the present case the decisive acceptance evidence is: Filled loan forms with different applicant values match while a similarly named unrelated form does not
C:A filename clue does not verify sensitive information matching within document content. In the present case the decisive acceptance evidence is: Filled loan forms with different applicant values match while a similarly named unrelated form does not
D:An isolated positive result cannot exclude the false positives the matching requirement must avoid. In the present case the decisive acceptance evidence is: Filled loan forms with different applicant values match while a similarly named unrelated form does not