Information Security Administrator study guide

Learn it in this order

Classification comes first because everything else refers to it. A label, a loss prevention rule and a retention policy all need to know what a document is before they can decide anything about it.

• Week 1. Sensitive information types, trainable classifiers, and what content inspection can and cannot see. This is the foundation and it is where most confusion starts.
• Weeks 2 to 3. Sensitivity labels: publishing, scoping, encryption, and what a label does to a file that travels outside the organisation.
• Weeks 3 to 4. Data loss prevention across locations, and retention. Learn the difference between a policy and a label, since the exam returns to it repeatedly.
• Week 5. Insider risk management and the alert work: policies, indicators, triage and cases.
• Week 6. Practice tests, then back to whichever area scored worst.

Labels and policies are not the same thing

More SC-401 questions turn on this distinction than on any other. A sensitivity label travels with the file and carries protection wherever it goes. A policy acts on activity in a location you have scoped. Get this clear and a whole class of question becomes easy.

• A label protects the file itself, so an encrypted document stays encrypted when it is attached to an ordinary message.
• A policy acts when somebody does something, which is why an untouched archive of sensitive files can sit under a correct policy for months and produce nothing.
• Retention labels and retention policies differ the same way: one is applied to an item, the other covers a location wholesale.
• Label order defines which is higher, so inserting one in the middle changes what counts as lowering a label elsewhere.
• Another organisation's labels mean nothing in your tenant. If partner documents matter, act on their contents.

Where people lose marks

The traps are mostly about scope: what a control covers, and what it quietly does not.

• Forgetting that archive mailboxes need to be a location in their own right, so old mail falls outside a policy scoped to primary mailboxes.
• Assuming a scan reads every file. A scanned page is an image until text recognition is enabled.
• Missing that endpoint activities are governed one by one, so a policy written around removable media leaves other paths open.
• Treating deletion as removal when retention applies. The item is kept out of sight until the period ends.
• Confusing what insider risk scores with what it can prove, and reaching for it where a loss prevention rule is the answer.

What the exam weights, and what that means for your time

The three areas carry the same weight as each other, which changes how you plan. There is no block worth prioritising on weighting alone, so choose by what you find hardest instead.

• Implementing information protection, 30 to 35%. Sensitive information types, trainable classifiers, sensitivity labels, and encryption for email.
• Data loss prevention and retention, 30 to 35%. DLP policies, Endpoint DLP, adaptive protection, retention labels and policies.
• Risks, alerts and activities, 30 to 35%. Insider risk management, Purview audit and alerts, and protecting data used by AI services.

Build these in a lab, once each

A trial tenant covers all of this. Purview is one of those products where an hour of clicking replaces a day of reading, because the settings are where the meaning lives.

• Publish a label with encryption, apply it to a document, and open that document as somebody without rights.
• Write a loss prevention rule in a mode that only reports, then read what it caught before you ever set it to block.
• Apply a retention policy, delete something covered by it, and go and find the item afterwards.
• Create a custom sensitive information type and test it against real documents, including ones that should not match.
• Turn on an insider risk policy and look at what it needs before it can score anybody, particularly the leaver feed.
• Send an encrypted message outside the tenant, then revoke it, so you have seen both ends of that.

How to use practice tests alongside this

Sit one after the classification block, not at the end. Everything later in the exam refers back to classification, so a gap there shows up everywhere, and finding that out in week two is worth more than finding it out in week six.

When a question goes wrong, ask whether you misread what the control covers rather than what it does. On this exam the answer is usually scope.