The hard set (6 questions)
The hardest SC-401 questions this guide publishes, none of them repeated from the placement quiz above: the answer first, why every other option is wrong, and the Microsoft Learn page behind it. The practice book for this exam holds the full bank.
During an investigation of a potentially compromised service account, a security analyst discovers that Get-MailboxAuditBypassAssociation returns True for the account in question. What are the full implications of a MailboxAuditBypassAssociation set to True for a service account?
Correct answer: D. The service account's own mailbox actions, its delegate actions on OTHER users' mailboxes (including shared mailboxes), and admin actions performed by that account are all unlogged, regardless of where they occur.
Microsoft Learn confirms: 'When you configure a user or computer account to bypass mailbox audit logging, access or actions taken by the user or computer account to any mailbox isn't logged.' The specific listing: (1) Mailbox owner actions that the bypassed users perform aren't logged; (2) Delegate actions that the bypassed users perform on other users' mailboxes (including shared mailboxes) aren't logged; (3) Admin actions that the bypassed users perform aren't logged. This is a complete audit blackout for that account. Organizations should audit the bypass list at regular intervals.
Why the other options are wrong:
- A. The bypass is not mailbox-location-specific. Archive mailboxes, shared mailboxes, and primary mailboxes are all affected when the account has a bypass association.
- B. The bypass applies to all mailbox actions, not just the account's own mailbox actions. Delegate actions on OTHER mailboxes are also unlogged for a bypassed account.
- C. The bypass is not operation-specific: read, send, delete, move, and delegate actions all go unlogged. There is no partial bypass by operation type.
Memory hook: MailboxAuditBypassAssociation = True means a COMPLETE audit blackout for that account: own mailbox, delegate access to ALL other mailboxes, admin actions. Nothing logs, anywhere. Check this list regularly.
Microsoft Learn: Audit mailboxes
DSPM for AI activates a one-click collection policy named 'DSPM for AI - Detect sensitive info shared with AI via network.' Compliance reviewers complain that activity explorer shows the detection but never the actual prompt and response text. What is the correct reason and fix?
Correct answer: D. This collection policy is created without the capture-content option selected; edit the policy and enable content capture to include prompts and responses
For collection policies, no prompt or response is displayed if the content-capture option is not selected. The one-click policy 'DSPM for AI - Detect sensitive info shared with AI via network' does not select that option when it is automatically created, but you can manually edit the policy afterward and enable content capture. That is the documented fix for seeing prompt and response text from this policy.
Why the other options are wrong:
- A. While reading prompt/response content does require a content-viewing role, the symptom here is that the text is never captured by this policy at all. Granting a role does not display text that the policy did not capture; the capture-content option must be enabled.
- B. Auditing controls Microsoft 365 Copilot interaction capture. For this network collection policy, the missing text is due to the unselected content-capture option, not disabled auditing.
- C. Collection policies can capture prompts and responses when the content-capture option is selected; they are not inherently incapable of it.
Memory hook: Network one-click collection policy ships with content capture OFF. See detections but no text? Edit the policy and turn content capture on.
Microsoft Learn: DSPM for ai considerations
A compliance lead wants to prioritize the improvement actions that raise the compliance score the most per action. In Compliance Manager's scoring model, which single action type is assigned the highest point value?
Correct answer: B. Preventative and mandatory (27 points).
Compliance Manager scores each improvement action on two axes: mandatory vs discretionary, and preventative/detective/corrective. Preventative + mandatory carries the highest value at 27 points. The full model is: Preventative mandatory 27, Preventative discretionary 9, Detective mandatory 3, Detective discretionary 1, Corrective mandatory 3, Corrective discretionary 1. So preventative/mandatory actions move the score most.
Why the other options are wrong:
- A. Wrong: Preventative discretionary is worth 9 points, not 15.
- C. Wrong: Detective mandatory is worth 3 points, not 18, and isn't the highest.
- D. Wrong: Corrective mandatory is worth 3 points, not 9.
Memory hook: Preventative + mandatory = 27, the max. Preventative-discretionary 9; detective/corrective mandatory 3; discretionary 1.
Microsoft Learn: Compliance manager scoring
A security engineer is automating large-scale audit log extraction and writes a script using Search-UnifiedAuditLog with a single SessionId. After retrieving 43,000 records in the first few pages, the engineer switches the -SessionCommand from ReturnLargeSet to ReturnNextPreviewPage on subsequent calls to get sorted results. The final result set has exactly 10,000 records. What happened?
Correct answer: D. Mixing ReturnLargeSet and ReturnNextPreviewPage against the same SessionId caps output at 10,000 records. The engineer should pick one command per session and stay with it: ReturnLargeSet for volume (up to 50,000, unsorted), ReturnNextPreviewPage for preview (up to 5,000, sorted).
Microsoft Learn explicitly documents this: 'Always use the same SessionCommand value for a given SessionId value. Don't switch between ReturnLargeSet and ReturnNextPreviewPage for the same session ID. Otherwise, the output is limited to 10,000 results.' ReturnLargeSet handles up to 50,000 records but returns unsorted results; ReturnNextPreviewPage handles up to 5,000 records with sorted results. To get sorted results from a large dataset, collect with ReturnLargeSet and sort the assembled collection afterward in PowerShell.
Why the other options are wrong:
- A. ReturnNextPreviewPage has a 5,000-record maximum (not 10,000) per session. The 10,000 cap the engineer hit is specifically caused by mixing the two session commands.
- B. There is no 10,000-record daily throttle for Search-UnifiedAuditLog in the tenant. The 10,000 outcome is the documented consequence of mixing SessionCommand values in a single session.
- C. The 10,000 cap is not RecordType-specific. It occurs when any session mixes ReturnLargeSet and ReturnNextPreviewPage, regardless of which record types are being searched.
Memory hook: NEVER mix ReturnLargeSet and ReturnNextPreviewPage in the same SessionId. Mixing = 10,000 record cap. Pick one: ReturnLargeSet (volume, unsorted, 50k max) OR ReturnNextPreviewPage (preview, sorted, 5k max).
Microsoft Learn: Search unifiedauditlog
Contoso has Microsoft 365 E5 for all users (Audit Premium). An investigator assumes every audit record is retained one year by default and needs Microsoft Teams administrative activity from 8 months ago. Will it be there by default, and why?
Correct answer: B. No: the Premium default 1-year retention covers only Microsoft Entra ID, Exchange, SharePoint, and OneDrive; other workloads such as Teams are retained 180 days by default unless a custom audit log retention policy extends them.
Audit (Premium)'s default audit log retention policy retains records for one year only for the four workloads whose Workload property is AzureActiveDirectory, Exchange, OneDrive, or SharePoint (for appropriately licensed users). Audit records for all other activities/workloads (for example, Teams) are retained 180 days by default. To keep them longer (up to one year, or 10 years with the add-on) you must create a custom audit log retention policy. So 8-month-old Teams records would already be gone by default.
Why the other options are wrong:
- A. Wrong: 10-year retention requires an add-on license and a custom retention policy; it isn't automatic.
- C. Wrong: Teams activity is captured in the unified audit log; the limitation is retention duration, not capture.
- D. Wrong: The 1-year default does not cover all workloads, only Entra ID, Exchange, SharePoint, and OneDrive.
Memory hook: Premium's 1-year default = Entra + Exchange + SharePoint + OneDrive only. Everything else (Teams, etc.) = 180 days unless you write a custom policy.
Microsoft Learn: Audit log retention policies
An organization's audit log retention policy configuration has the following custom policies in place: Policy A (priority 5): retain Exchange records for 7 years; Policy B (priority 3): retain Exchange records for 30 days. The Premium default policy retains Exchange/SharePoint/OneDrive/Entra records for 1 year. An Exchange audit record is generated today for an E5 user. Which policy applies and why?
Correct answer: A. Policy B (30 days) applies because it has the lower priority number (3) which means highest priority, and any custom policy outranks the built-in default.
Audit retention policy priority rules: (1) lower priority NUMBER = higher priority (wins); (2) any custom policy always outranks the Premium built-in default policy. Policy B has priority 3, Policy A has priority 5, so Policy B wins. Microsoft Learn confirms: 'All custom audit log retention policies (created by your organization) take priority over the default retention policy.' Therefore Policy B (30 days) applies to this Exchange record for the E5 user. The result is 30-day retention despite the Premium default and the 7-year custom policy also matching.
Why the other options are wrong:
- B. This is the opposite of how it works. Custom policies ALWAYS outrank the Premium built-in default. Built-in defaults are the lowest priority, never the highest.
- C. Recency of creation has no bearing on audit retention policy priority. The priority NUMBER is the only determinant, with lower numbers winning.
- D. The 'retention wins over deletion' principle applies to MRM retention labels and retention policies on content, not to audit log retention policy priority. Audit retention policy priority is a pure priority-number contest.
Memory hook: Audit retention priority: lower number = WINS. Custom ALWAYS beats built-in default. Priority 3 beats priority 5 beats the default. Short custom policy can silently cut retention you thought you had.
Microsoft Learn: Audit log retention policies
