Microsoft Certified:Information Security Administrator Associate
Domain 3Objective 1
Implement and Manage Microsoft Purview Insider Risk Management SC-401 Practice Questions (Page 9)
Part of the Manage risks, alerts, and activities domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)
52questions here
11free pages
13concepts
30–35%of the exam
Questions 41–45
- 41
What is the purpose of a notice template in Insider Risk Management?
Select an answer first - 42
A security team has enabled the Microsoft Defender for Endpoint (MDE) connector in Insider Risk Management. They notice that some alerts from MDE are not appearing in IRM. They have verified that the users are licensed and the connector is enabled. What is the most likely cause of the missing alerts?
Select an answer first - 43
An investigator needs to collect forensic evidence for a case involving a user who is suspected of copying sensitive files to a USB drive. The user's device is enrolled in Microsoft Intune and has the Insider Risk Management device indicator enabled. However, the 'Forensic evidence' tab in the case is not available. What is the most likely reason?
Select an answer first - 44
Which of the following is an example of a policy indicator in Insider Risk Management?
Select an answer first - 45
Which role group in Microsoft Purview includes the Insider Risk Management Admin role and is used to grant full access to Insider Risk Management features?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.