Which policy template would you select to detect activities related to employees leaving the company and taking sensitive data?

General security policy violations

Your organization uses Microsoft Defender for Endpoint (MDE) and wants Insider Risk Management to include endpoint activities like copying files to USB drives. You have enabled the MDE integration in the Insider Risk Management settings. What else must you do to ensure these signals appear in alerts?

Enable the 'Device indicator' policy indicators in the policy.

Install the Microsoft 365 connector for Defender for Endpoint.

Create a separate policy for each device.

Assign users to the Insider Risk Management Investigators role.

A new security analyst joins the Insider Risk Management team. They need to view and manage alerts, but should not be able to view cases or configure policies. Which role should you assign?

Insider Risk Management Analysts

Insider Risk Management Investigators

Insider Risk Management Approvers

When creating a new Insider Risk Management policy, which of the following must you specify?

The email notifications for alerts

The policy template and the users in scope

The role assignments for investigators

Microsoft Certified:Information Security Administrator Associate

Domain 3Objective 1

Implement and Manage Microsoft Purview Insider Risk Management SC-401 Practice Questions (Page 4)

Part of the Manage risks, alerts, and activities domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

13concepts

30–35%of the exam

Questions 16–20

16foundation · easy
Which policy template would you select to detect activities related to employees leaving the company and taking sensitive data?
Select an answer first
17application · medium
Your organization uses Microsoft Defender for Endpoint (MDE) and wants Insider Risk Management to include endpoint activities like copying files to USB drives. You have enabled the MDE integration in the Insider Risk Management settings. What else must you do to ensure these signals appear in alerts?
Select an answer first
18application · medium
Your organization wants to automatically apply stricter policies to users who are identified as high-risk by Insider Risk Management. Which feature should you enable?
Select an answer first
19application · medium
A new security analyst joins the Insider Risk Management team. They need to view and manage alerts, but should not be able to view cases or configure policies. Which role should you assign?
Select an answer first
20foundation · easy
When creating a new Insider Risk Management policy, which of the following must you specify?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.

Implement and Manage Microsoft Purview Insider Risk Management SC-401 Practice Questions (Page 4)

Questions 16–20

Which policy template would you select to detect activities related to employees leaving the company and taking sensitive data?

Your organization wants to automatically apply stricter policies to users who are identified as high-risk by Insider Risk Management. Which feature should you enable?

A new security analyst joins the Insider Risk Management team. They need to view and manage alerts, but should not be able to view cases or configure policies. Which role should you assign?

When creating a new Insider Risk Management policy, which of the following must you specify?

Keep studying — Manage risks, alerts, and activities