Microsoft SC-401 Exam With Confidence Using Practice Dumps

To meet the requirement that all administrative users must be able to create Microsoft 365 sensitivity labels, we need to assign the Sensitivity Label Administrator role to the correct users.

Sensitivity Label Administrator Role Responsibilities

This role allows users to:

● Create and manage sensitivity labels in Microsoft Purview.

● Publish and configure auto-labeling policies.

● Modify label encryption and content marking settings.

Review of Admin Roles from the Table:

Users that must be assigned the Sensitivity Label Administrator role:

● Admin2 (Compliance Data Administrator)

● Admin3 (Compliance Administrator)

● Admin1 (Global Reader) (should be assigned this role to fulfill the requirement that all admins can create labels).

An activity policy in Microsoft Defender for Cloud Apps (Microsoft Defender portal) allows you to track and alert on specific user actions, such as sharing sensitive documents externally from OneDrive. This policy can detect file-sharing activities and send alerts when files are shared with external users, which meets the requirement.

Create one service domain group (Allow list) containing Site1 and Site2 and configure the policy action “Allow upload only to sensitive service domains”.

Create a second service domain group (Block list) containing Search1 and Search2 and configure the policy action to block paste (clipboard) to these domains.

A single Endpoint DLP policy can enforce multiple activities (upload to cloud service domains + clipboard to specific domains), so only one policy is required.

Refs: Microsoft Learn – Endpoint DLP: Configure service domains and policy actions (upload/clipboard restrictions) (Purview > Data loss prevention > Endpoint DLP settings and policies).