A company wants to detect employees who exfiltrate sensitive data via personal webmail. They have Microsoft 365 E5 and want to use Insider Risk Management. Which connector and policy template combination should you implement?

Azure AD connector and Security policy violations template.

Microsoft Defender for Endpoint connector and Data leaks template.

Microsoft 365 HR connector and Data theft by departing users template.

Microsoft 365 connector (Exchange Online) and Data leaks template.

An organization wants to detect when employees share sensitive files externally via email. They have enabled Insider Risk Management and created a policy. Which indicator should they enable to meet this requirement?

Enable the 'Sharing files with external users' indicator.

Enable the 'Uploading content to a personal cloud storage site' indicator.

Enable the 'Downloading content from Microsoft 365' indicator.

Enable the 'Sending email with attachments to external recipients' indicator.

Your organization wants to restrict access to Insider Risk Management so that only the compliance team can create policies, while the security operations team can only view alerts. What is the most efficient way to configure permissions?

Use the built-in role groups and assign users accordingly.

Assign each user individual permissions in the Microsoft Purview compliance portal.

Create custom role groups with specific permissions.

Use Azure AD roles to control access.

In Insider Risk Management settings, what does the 'Privacy' setting control?

Whether usernames are displayed as pseudonyms in alerts and cases

Whether policies can be created by non-admins

Whether data is stored in a specific region

Whether alerts are sent to external parties

A large enterprise has enabled Adaptive Protection and created several Insider Risk Management policies. They want to ensure that users who trigger high-risk policies are automatically assigned a 'High risk' level and that this level is used to apply a stricter data loss prevention (DLP) policy. However, they are concerned that some users might be incorrectly classified due to false positives. What should they do to minimize incorrect risk level assignments?

Disable Adaptive Protection and use a single DLP policy for all users.

Configure the Adaptive Protection risk level to be based on the number of policy matches and require a minimum of two matches before assigning 'High risk'.

Enable the 'Risk level' indicator in the policy and set it to 'High' for all users.

Assign the 'High risk' level manually to users after reviewing each alert.

Microsoft Certified:Information Security Administrator Associate

Domain 3Objective 1

Implement and Manage Microsoft Purview Insider Risk Management SC-401 Practice Questions (Page 1)

Part of the Manage risks, alerts, and activities domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

13concepts

30–35%of the exam

Questions 1–5

1application · medium
A company wants to detect employees who exfiltrate sensitive data via personal webmail. They have Microsoft 365 E5 and want to use Insider Risk Management. Which connector and policy template combination should you implement?
Select an answer first
2application · easy
An organization wants to detect when employees share sensitive files externally via email. They have enabled Insider Risk Management and created a policy. Which indicator should they enable to meet this requirement?
Select an answer first
3application · medium
Your organization wants to restrict access to Insider Risk Management so that only the compliance team can create policies, while the security operations team can only view alerts. What is the most efficient way to configure permissions?
Select an answer first
4foundation · easy
In Insider Risk Management settings, what does the 'Privacy' setting control?
Select an answer first
5expert · hard
A large enterprise has enabled Adaptive Protection and created several Insider Risk Management policies. They want to ensure that users who trigger high-risk policies are automatically assigned a 'High risk' level and that this level is used to apply a stricter data loss prevention (DLP) policy. However, they are concerned that some users might be incorrectly classified due to false positives. What should they do to minimize incorrect risk level assignments?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.