An Insider Risk Management analyst notices an alert for a user who downloaded a large number of files before resigning. The analyst needs to escalate this to a formal investigation and notify the user's manager about the investigation. What should the analyst do?

Open the alert, create a case from it, and use the 'Notice template' to send a notification to the manager.

Open the alert and use the 'Send email' option to notify the manager directly.

Open the alert and use the 'Assign to' feature to assign the alert to the manager.

Create a case from the alert and then use the 'Activity explorer' to send the notification.

What is the primary purpose of an Insider Risk Management policy?

To define the conditions that trigger alerts and the users included in monitoring

To assign permissions to security analysts

To set the retention period for audit logs

A company wants to use HR data such as termination dates and performance reviews as indicators in Insider Risk Management. Which connector should you configure?

Microsoft Defender for Endpoint connector

An investigator is working on an insider risk case and needs to track all communication and evidence related to the case in one place. They also need to escalate the case to legal with a summary. What should the investigator do?

Create a new alert and assign it to the legal team.

Use the case notes to document findings, attach evidence, and use the 'Escalate to legal' option in the case.

Use the 'Activity explorer' to share the case details with legal.

Export the case data to Excel and email it to the legal team.

What must be enabled to use forensic evidence features in Insider Risk Management?

A connector to a third-party forensic tool

Forensic evidence must be enabled in the Insider Risk Management settings

A special license for each user

The user must be assigned the Forensic Investigator role

Microsoft Certified:Information Security Administrator Associate

Domain 3Objective 1

Implement and Manage Microsoft Purview Insider Risk Management SC-401 Practice Questions (Page 7)

Part of the Manage risks, alerts, and activities domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

13concepts

30–35%of the exam

Questions 31–35

31application · medium
An Insider Risk Management analyst notices an alert for a user who downloaded a large number of files before resigning. The analyst needs to escalate this to a formal investigation and notify the user's manager about the investigation. What should the analyst do?
Select an answer first
32foundation · easy
What is the primary purpose of an Insider Risk Management policy?
Select an answer first
33application · medium
A company wants to use HR data such as termination dates and performance reviews as indicators in Insider Risk Management. Which connector should you configure?
Select an answer first
34application · medium
An investigator is working on an insider risk case and needs to track all communication and evidence related to the case in one place. They also need to escalate the case to legal with a summary. What should the investigator do?
Select an answer first
35foundation · easy
What must be enabled to use forensic evidence features in Insider Risk Management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.