What is the first step in managing an Insider Risk Management alert?

Review the alert details and determine if it warrants investigation

A company wants to use Adaptive Protection to apply stricter DLP policies to high-risk users. However, they are concerned that the risk level assignments might be too aggressive and block legitimate work. What should you do to balance security and productivity?

Configure multiple risk levels and assign appropriate policies to each level.

Disable Adaptive Protection and use static DLP policies.

Use only one risk level for all users.

Set the risk level to 'High' for all users.

A company wants to monitor for employees sending confidential files to personal email accounts. They have Microsoft 365 E5 and have enabled Insider Risk Management. Which policy indicators should you enable to detect this activity?

SharePoint site indicators such as 'Download from SharePoint'

Email activity indicators such as 'Email sent to personal domains' and 'Email with sensitive info'

Device indicators such as 'Copy to USB'

Azure AD sign-in indicators such as 'Impossible travel'

An organization uses ServiceNow for HR data and wants to use termination dates and performance warnings as indicators in Insider Risk Management. They have already enabled IRM and assigned roles. What should they configure to bring this data into IRM?

Configure the HR connector in the Microsoft Purview compliance portal and map the ServiceNow fields to the required HR schema.

Create a custom policy with the 'General data leaks' template and select ServiceNow as a data source.

Enable the 'ServiceNow' connector in the Insider Risk Management settings and upload a CSV of HR events.

Use the Microsoft Graph API to push HR data directly into the Insider Risk Management policy engine.

A compliance team wants to ensure that when an insider risk case is opened, the involved employee is automatically notified with a standard message about the investigation. They have already created the message. What should they configure in Insider Risk Management?

Configure an email notification in the policy settings to send the message when an alert is generated.

Create a Power Automate flow that sends the message when a case is created.

Use the 'Alert' email notification feature to send the message to the employee.

Create a notice template and associate it with the case workflow so it is sent when a case is opened.

Microsoft Certified:Information Security Administrator Associate

Domain 3Objective 1

Implement and Manage Microsoft Purview Insider Risk Management SC-401 Practice Questions (Page 8)

Part of the Manage risks, alerts, and activities domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

13concepts

30–35%of the exam

Questions 36–40

36foundation · easy
What is the first step in managing an Insider Risk Management alert?
Select an answer first
37expert · hard
A company wants to use Adaptive Protection to apply stricter DLP policies to high-risk users. However, they are concerned that the risk level assignments might be too aggressive and block legitimate work. What should you do to balance security and productivity?
Select an answer first
38application · medium
A company wants to monitor for employees sending confidential files to personal email accounts. They have Microsoft 365 E5 and have enabled Insider Risk Management. Which policy indicators should you enable to detect this activity?
Select an answer first
39application · medium
An organization uses ServiceNow for HR data and wants to use termination dates and performance warnings as indicators in Insider Risk Management. They have already enabled IRM and assigned roles. What should they configure to bring this data into IRM?
Select an answer first
40application · medium
A compliance team wants to ensure that when an insider risk case is opened, the involved employee is automatically notified with a standard message about the investigation. They have already created the message. What should they configure in Insider Risk Management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.