SC-401 study plan

Week 1chapters 1–4 · about 9 hours Done

• Read these chapters:
  • 1. Microsoft Purview for information security administrators
  • 2. Classifying data: sensitive information types, fingerprints, EDM and OCR
  • 3. Trainable classifiers and monitoring classification
  • 4. Sensitivity labels: design, protection and publishing
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Exact data match (EDM) sensitive information types in Microsoft Purview, Microsoft Purview sensitivity labels: scopes, priority and sublabels.
• Look up any unfamiliar term in the SC-401 glossary.

Exam skill areas this week: Implement information protection · 30–35%Manage risks, alerts, and activities · 30–35%

Week 2chapters 5–7 · about 7 hours Done

• Read these chapters:
  • 5. Applying labels automatically and to containers
  • 6. Information protection for Windows, file shares and Exchange
  • 7. Designing and managing DLP policies
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Microsoft Purview DLP policy states and simulation mode.
• Look up any unfamiliar term in the SC-401 glossary.

Exam skill areas this week: Implement information protection · 30–35%Implement data loss prevention and retention · 30–35%

Week 3chapters 8–14 · about 9 hours Done

• Read these chapters:
  • 8. Endpoint DLP and Defender for Cloud Apps file policies
  • 9. Retention policies and the principles of retention
  • 10. Retention labels, auto-apply and records management
  • 11. Insider Risk Management
  • 12. Audit, Activity explorer and responding to alerts
  • 13. eDiscovery
  • 14. Protecting data used by AI
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Endpoint DLP device requirements and onboarding in Microsoft Purview, Microsoft Purview Audit (Standard) vs Audit (Premium): retention and licences.
• Look up any unfamiliar term in the SC-401 glossary.

Exam skill areas this week: Implement data loss prevention and retention · 30–35%Manage risks, alerts, and activities · 30–35%

Week 4review Done

• Go back through every chapter’s key takeaways. Anything you can’t explain without looking, re-read that section.
• Re-read the common-trap callouts: they mark the answers that look right but aren’t.
• Check the exam coverage map against Microsoft’s own outline, in case it has changed since the book was checked.
• Take Microsoft’s free practice assessment, if your exam has one, from the official SC-401 study guide page. Revisit the chapters behind any weak area.
• Try the exam sandbox to get used to the exam’s screens and question formats.
• Get the free exam-day checklist and work through it a few days before your exam.

Week 1chapters 1–2 · about 4 hours Done

• Read these chapters:
  • 1. Microsoft Purview for information security administrators
  • 2. Classifying data: sensitive information types, fingerprints, EDM and OCR
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Exact data match (EDM) sensitive information types in Microsoft Purview.
• Look up any unfamiliar term in the SC-401 glossary.

Exam skill areas this week: Implement information protection · 30–35%

Week 2chapters 3–4 · about 4 hours Done

• Read these chapters:
  • 3. Trainable classifiers and monitoring classification
  • 4. Sensitivity labels: design, protection and publishing
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Microsoft Purview sensitivity labels: scopes, priority and sublabels.
• Look up any unfamiliar term in the SC-401 glossary.

Exam skill areas this week: Implement information protection · 30–35%Manage risks, alerts, and activities · 30–35%

Week 3chapter 5 · about 2 hours Done

• Read chapter:
  • 5. Applying labels automatically and to containers
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Look up any unfamiliar term in the SC-401 glossary.

Exam skill areas this week: Implement information protection · 30–35%

Week 4chapters 6–7 · about 4 hours Done

• Read these chapters:
  • 6. Information protection for Windows, file shares and Exchange
  • 7. Designing and managing DLP policies
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Microsoft Purview DLP policy states and simulation mode.
• Look up any unfamiliar term in the SC-401 glossary.

Exam skill areas this week: Implement information protection · 30–35%Implement data loss prevention and retention · 30–35%

Week 5chapter 8 · about 2 hours Done

• Read chapter:
  • 8. Endpoint DLP and Defender for Cloud Apps file policies
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Endpoint DLP device requirements and onboarding in Microsoft Purview.
• Look up any unfamiliar term in the SC-401 glossary.

Exam skill areas this week: Implement data loss prevention and retention · 30–35%

Week 6chapters 9–10 · about 3 hours Done

• Read these chapters:
  • 9. Retention policies and the principles of retention
  • 10. Retention labels, auto-apply and records management
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Look up any unfamiliar term in the SC-401 glossary.

Exam skill areas this week: Implement data loss prevention and retention · 30–35%

Week 7chapters 11–14 · about 3 hours Done

• Read these chapters:
  • 11. Insider Risk Management
  • 12. Audit, Activity explorer and responding to alerts
  • 13. eDiscovery
  • 14. Protecting data used by AI
• After each chapter, cover its key takeaways and explain each one out loud. Re-read any you can’t.
• Free study notes for this week: Microsoft Purview Audit (Standard) vs Audit (Premium): retention and licences.
• Look up any unfamiliar term in the SC-401 glossary.

Exam skill areas this week: Manage risks, alerts, and activities · 30–35%

Week 8review Done

• Go back through every chapter’s key takeaways. Anything you can’t explain without looking, re-read that section.
• Re-read the common-trap callouts: they mark the answers that look right but aren’t.
• Check the exam coverage map against Microsoft’s own outline, in case it has changed since the book was checked.
• Take Microsoft’s free practice assessment, if your exam has one, from the official SC-401 study guide page. Revisit the chapters behind any weak area.
• Try the exam sandbox to get used to the exam’s screens and question formats.
• Get the free exam-day checklist and work through it a few days before your exam.