What is the minimum role required for a user to view Insider Risk Management alerts but not modify policies?

Insider Risk Management Analysts

Insider Risk Management Auditors

Insider Risk Management Investigators

Insider Risk Management Approvers

A company wants to detect insider threats involving unusual file access patterns on Windows 10 devices. They have Microsoft Defender for Endpoint (MDE) deployed and want to use those signals in Insider Risk Management. What must the admin do to enable this integration?

Assign the 'Insider Risk Management Admins' role to the security team and enable the 'Device indicators' toggle in the MDE security portal.

Install the Microsoft 365 compliance connector on each Windows 10 device to forward Defender alerts to Insider Risk Management.

Enable the 'Microsoft Defender for Endpoint' connector in Insider Risk Management settings and ensure users are assigned a Defender for Endpoint license.

Create a custom policy using the 'Security policy violations' template and select 'Microsoft Defender for Endpoint' as the data source.

What is the purpose of a case in Insider Risk Management?

To consolidate alerts and evidence for a single investigation

What does the integration between Insider Risk Management and Microsoft Defender for Endpoint provide?

Insider Risk Management policies are enforced by Defender for Endpoint

Defender for Endpoint blocks all insider risk activities

Alerts from Defender for Endpoint are used as indicators in Insider Risk Management policies

Insider Risk Management replaces Defender for Endpoint

Microsoft Certified:Information Security Administrator Associate

Domain 3Objective 1

Implement and Manage Microsoft Purview Insider Risk Management SC-401 Practice Questions (Page 10)

Part of the Manage risks, alerts, and activities domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

13concepts

30–35%of the exam

Questions 46–50

46foundation · easy
What is the minimum role required for a user to view Insider Risk Management alerts but not modify policies?
Select an answer first
47application · medium
A company wants to detect insider threats involving unusual file access patterns on Windows 10 devices. They have Microsoft Defender for Endpoint (MDE) deployed and want to use those signals in Insider Risk Management. What must the admin do to enable this integration?
Select an answer first
48foundation · easy
What is the purpose of a case in Insider Risk Management?
Select an answer first
49foundation · easy
What does the integration between Insider Risk Management and Microsoft Defender for Endpoint provide?
Select an answer first
50foundation · easy
What action can be taken on an Insider Risk Management alert after it has been reviewed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.