A company uses a custom HR system that does not have a pre-built connector in Microsoft Purview. They want to use HR signals such as resignation dates and performance warnings in Insider Risk Management. The compliance team has limited development resources and needs a solution that is supported and maintainable. What should they do?

Use the Office 365 Management Activity API to ingest HR data into Insider Risk Management.

Use the Microsoft Graph API to directly push HR data into the Insider Risk Management policy engine.

Create a custom policy using the 'General data leaks' template and select the HR system as a data source.

Use the HR connector with a custom CSV import scheduled via PowerShell to upload HR data daily.

What is the purpose of policy indicators in Insider Risk Management?

To set the retention period for alerts

To define the specific activities that trigger alerts

Which of the following is a typical action performed on a case in Insider Risk Management?

Assign the case to an investigator

During an insider risk investigation, you need to provide forensic evidence of a user's activity to legal. Which feature should you use to capture and preserve this evidence?

Use the 'Activity explorer' to export a report of user activities.

Enable 'Forensic evidence' in the Insider Risk Management settings and create a policy that includes forensic evidence capture.

Use Microsoft Defender for Endpoint's investigation package.

Create a case and use the 'Case notes' to document evidence.

Microsoft Certified:Information Security Administrator Associate

Domain 3Objective 1

Implement and Manage Microsoft Purview Insider Risk Management SC-401 Practice Questions (Page 6)

Part of the Manage risks, alerts, and activities domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

13concepts

30–35%of the exam

Questions 26–30

26expert · hard
A company uses a custom HR system that does not have a pre-built connector in Microsoft Purview. They want to use HR signals such as resignation dates and performance warnings in Insider Risk Management. The compliance team has limited development resources and needs a solution that is supported and maintainable. What should they do?
Select an answer first
27foundation · easy
What is the purpose of policy indicators in Insider Risk Management?
Select an answer first
28foundation · easy
Which of the following is a typical action performed on a case in Insider Risk Management?
Select an answer first
29foundation · easy
Which connector is commonly used to bring HR termination data into Insider Risk Management for detecting potential insider threats?
Select an answer first
30application · medium
During an insider risk investigation, you need to provide forensic evidence of a user's activity to legal. Which feature should you use to capture and preserve this evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.

Implement and Manage Microsoft Purview Insider Risk Management SC-401 Practice Questions (Page 6)

Questions 26–30

What is the purpose of policy indicators in Insider Risk Management?

Which of the following is a typical action performed on a case in Insider Risk Management?

Which connector is commonly used to bring HR termination data into Insider Risk Management for detecting potential insider threats?

During an insider risk investigation, you need to provide forensic evidence of a user's activity to legal. Which feature should you use to capture and preserve this evidence?

Keep studying — Manage risks, alerts, and activities