SC-401 decision sheets

• Adaptive Protection: making a DLP policy risk-aware
• Audit log: retention durations, roles, and search limits
• Defender for Cloud Apps file policy: the building blocks
• DLP investigation: roles and where to triage alerts
• DLP simulation mode: what runs, and what policy tips change
• DSPM for AI roles: view-only, create-and-edit, or prompt content
• DSPM for AI: which default policy, and which solution owns it
• DSPM for AI prerequisites, per monitoring target
• Insider risk forensic evidence: why no clips are captured
• Insider risk templates: which scenario, which prerequisite
• Insider Risk Management role groups: least-privilege matrix
• Label policy settings vs auto-labeling
• Retention conflicts: which action wins?
• Retention label vs retention policy
• Retention policy locations: what can share one policy
• Where retention preserves deleted content, per workload
• Static scope vs adaptive scope
• Roles for creating vs changing sensitivity labels
• Choosing a sensitive information type: EDM vs named entity vs keyword dictionary