Free Microsoft SC-400 Exam Dumps Questions & Answers

You have a Microsoft 365 subscription.
You have a user named Userl. Several users have full access to the mailbox of Userl.
Some email messages sent to User1 appear to have been read and deleted before the user viewed them.
When you search the audit log in the Microsoft Purview compliance portal to identify who signed in to the mailbox of User1, the results are blank.
You need to ensure that you can view future sign-ins to the mailbox of User1.
Solution: You run the Set-Mailbox -identity ''User1'' -AuditEnabled $true command.
Does that meet the goal?

• A.  No
• B.  Yes

You have a Microsoft 365 E5 subscription that contains a data loss prevention (DLP) policy named DLP1. DLP1 contains the DLP rules shown in the table.

You need to ensure that when a document matches all the rules, users will see Tip 2. What should you change?

• A.  the priority setting of Rule2 to 2
• B.  the priority setting of Rule3 and Rule4 to 0
• C.  the If there's a match for this rule, stop processing additional DLP policies and rules setting for Rule3 to Enabled
• D.  the priority setting of Rule2 to 0

You have a Microsoft 365 subscription. Auditing is enabled.
A user named User1 is a member of a dynamic security group named Group1.
You discover that User1 is no longer a member of Group1.
You need to search the audit log to identify why User1 was removed from Group1.
Which two activities should you use in the search? To answer, select the appropriate activities in the answer area.

Correct Answer:

You have a Microsoft 365 E5 tenant that contains a user named User1.
You need to identify the type and number of holds placed on the mailbox of User1.
What should you do first?

• A.  From Exchange Online PowerShell. run the Gee-Mailbox cmdlet.
• B.  From the Microsoft 365 compliance center, create an eDiscovery case.
• C.  From the Microsoft 365 compliance center, run a content search.
• D.  From Exchange Online PowerShell. run the Get-HoldCompliancePolicy cmdlet.

You have a Microsoft 365 tenant that uses 100 data loss prevention (DLP) policies.
A Microsoft Exchange administrator frequently investigates emails that were blocked due to DLP policy violations.
You need to recommend which DLP report the Exchange administrator can use to identify how many messages were blocked based on each DLP policy.
Which report should you recommend?

• A.  False positive and override
• B.  DLP incidents
• C.  Third-party DLP policy matches
• D.  DLP policy matches