Exam SC-400 topic 1 question 1 discussion

Tested. "For Defender for Cloud Apps to apply sensitivity labels, they must be published as part of a sensitivity label policy in the Microsoft 365 compliance center." does not mention auto-labeling policy as an option.

I believe the answer provided is correct for the following reasons: 1. You cannot add an empty sensitivity label to a policy, and because no information about 'Sensitivity3' is provided we have to assume that it is empty 2. 'Sensitivity1' has already been published so it is not empty 3. Information about 'Sensitivity2' is provided so it is not empty https://docs.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide

auto label cannot be applied to cloud app security and non-publised cannot be appied. Therefore, it is only Sensitivity1. Answer is A

just tested it, only the published labels appear, labels with Auto-apply labeling policy dont appear in the governance actions of File policy in MDCA

Tested in a sandbox tenant, only sensitivity1 is available

D. is correct. Sensitivity labels need to be published in order to work and Sensitivity2 is already working now you just need to create an auto-label policy. Microsoft was sneaky with the wording here.

just tested it, its Sensitivity label 1 only so answer is A

Selected Answer: A

A, since you can only apply sensitivty labels that has been published and the other one has been used in an auto-labeling policy which means that it wont be available in this file policy that you are creating. "For Defender for Cloud Apps to apply sensitivity labels, they must be published as part of a sensitivity label policy in the Microsoft Purview compliance portal."

For Defender for Cloud Apps to apply sensitivity labels, they must be published as part of a sensitivity label policy in the Microsoft Purview compliance portal. https://learn.microsoft.com/en-us/defender-cloud-apps/azip-integration#prerequisites

You (the user) cannot apply Sensitivity2. It is published with an auto-labeling policy. An auto-labeling policy is server-side labeling (meaning automatic not manual). Because server-side labeling is applied by services rather than by applications, you cannot set an MCAS filter your data based on Sensitivity2. https://docs.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide - See where it says server-side labeling

I have just tested this in my test tenant - I was able to create an auto-labelling policy for a custom sensitivity label and then auto-assign this to SharePoint sites only or indeed specific SharePoint sites only. Therefore, the answer here is D - Sensitivity 1 and 2.

at https://docs.microsoft.com/en-us/defender-cloud-apps/file-filters#file-filters is written for the Sensitivity label: "- Search for files with specific labels set." so a lable must be able to apply to a file. This is true for published lables (manual) but also for auto-labeling policy. so Answer D is correct

Correct answer

I think correct anser is B. As you can use any created sensitivity labels even if it is not published.