Implement and Manage Microsoft Purview Insider Risk Management SC-401 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which setting in Insider Risk Management determines how long data is retained before being purged?

   • APolicy indicators settings
   • BData retention settings
   • CRole assignment settings
   • DAlert volume settings
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which role group should be used to grant a user permission to approve cases in Insider Risk Management?

   • AInsider Risk Management Investigators
   • BInsider Risk Management Admins
   • CInsider Risk Management Analysts
   • DInsider Risk Management Approvers
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An Insider Risk Management alert has been generated for a user. The security analyst has reviewed it and determined that the activity is a false positive. What should the analyst do?

   • ADismiss the alert and add a note explaining why.
   • BDelete the alert permanently.
   • CCreate a case and close it as 'No risk'
   • DEscalate the alert to a case for further investigation.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the purpose of forensic evidence in Insider Risk Management?

   • ATo capture and store user activity snapshots for investigation
   • BTo delete user data
   • CTo automatically block user activities
   • DTo send alerts to users
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the purpose of Adaptive Protection in Insider Risk Management?

   • ATo replace all other Insider Risk Management policies
   • BTo provide a static set of policies for all users
   • CTo automatically adjust risk levels and apply appropriate responses based on user risk
   • DTo block all user activity
   Reveal Solution Discussion Select an answer first