An insider risk alert has been escalated to a case. The investigation reveals that the user's activity was actually a result of a malware infection, not intentional data exfiltration. What should you do with the case?

Dismiss the alert without resolving the case.

Escalate the case to legal for potential litigation.

Resolve the case with a status of 'No risk' and document the malware finding.

Keep the case open until the malware is fully remediated.

A legal team needs to collect forensic evidence for a specific insider risk case involving a user who allegedly copied sensitive files to a USB drive. They want to capture device activity and file access logs for that user. What should the admin configure in Insider Risk Management?

Enable 'Forensic evidence' in the policy and then use the 'Activity explorer' to export the evidence.

Enable 'Device indicators' and 'Forensic evidence' in the policy, then create a case and use the 'Forensic evidence' tab to collect the evidence.

Enable 'Forensic evidence' in the policy and then use the 'Content search' tool to find the evidence.

Enable 'Device indicators' in the policy and then use the 'Alerts' tab to download the evidence.

Your organization has a policy to send a warning notice to users when they trigger an insider risk alert. However, you want to avoid sending notices for low-risk alerts to reduce unnecessary user anxiety. What is the best way to achieve this?

Configure the notice template to be sent only when the alert risk score is above a certain threshold.

Enable notices for all alerts and let users decide.

Create a separate policy for high-risk alerts with notices enabled.

Send notices manually for high-risk alerts only.

Microsoft Certified:Information Security Administrator Associate

Domain 3Objective 1

Implement and Manage Microsoft Purview Insider Risk Management SC-401 Practice Questions (Page 3)

Part of the Manage risks, alerts, and activities domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

13concepts

30–35%of the exam

Questions 11–15

11expert · hard
An insider risk alert has been escalated to a case. The investigation reveals that the user's activity was actually a result of a malware infection, not intentional data exfiltration. What should you do with the case?
Select an answer first
12application · medium
A legal team needs to collect forensic evidence for a specific insider risk case involving a user who allegedly copied sensitive files to a USB drive. They want to capture device activity and file access logs for that user. What should the admin configure in Insider Risk Management?
Select an answer first
13foundation · easy
Which risk levels can be used in Adaptive Protection?
Select an answer first
14expert · hard
Your organization has a policy to send a warning notice to users when they trigger an insider risk alert. However, you want to avoid sending notices for low-risk alerts to reduce unnecessary user anxiety. What is the best way to achieve this?
Select an answer first
15application · medium
Your organization wants to automatically send a reminder to users when they trigger an insider risk alert, reminding them of the acceptable use policy. Which feature should you configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.

Implement and Manage Microsoft Purview Insider Risk Management SC-401 Practice Questions (Page 3)

Questions 11–15

An insider risk alert has been escalated to a case. The investigation reveals that the user's activity was actually a result of a malware infection, not intentional data exfiltration. What should you do with the case?

A legal team needs to collect forensic evidence for a specific insider risk case involving a user who allegedly copied sensitive files to a USB drive. They want to capture device activity and file access logs for that user. What should the admin configure in Insider Risk Management?

Which risk levels can be used in Adaptive Protection?

Your organization has a policy to send a warning notice to users when they trigger an insider risk alert. However, you want to avoid sending notices for low-risk alerts to reduce unnecessary user anxiety. What is the best way to achieve this?

Your organization wants to automatically send a reminder to users when they trigger an insider risk alert, reminding them of the acceptable use policy. Which feature should you configure?

Keep studying — Manage risks, alerts, and activities