Manage Information Security Alerts and Activities SC-401 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which Microsoft Purview solution is used to perform searches for content relevant to security investigations?

   • AInsider Risk Management
   • BCompliance Manager
   • CeDiscovery
   • DData Loss Prevention
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of an eDiscovery search in a security investigation?

   • ATo reset user passwords
   • BTo locate and collect relevant data for analysis
   • CTo block malicious files
   • DTo configure firewall rules
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization is required by a new compliance regulation to retain audit logs for all user activities in Exchange Online for a minimum of 3 years. The organization currently has Microsoft Purview Audit (Standard) enabled for all users. What should the security administrator configure to meet this requirement?

   • AUse the default audit retention policy, which retains logs for 10 years.
   • BEnable Microsoft Purview Audit (Premium) for all users to extend the default retention to 10 years.
   • CCreate a custom audit retention policy for Exchange Online activities with a retention period of 3 years.
   • DExport the audit logs to a third-party SIEM and store them for 3 years.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   The security team at Fabrikam receives a DLP alert in Purview and a file policy alert in Defender for Cloud Apps for the same user. The team wants to respond to both alerts, but they have limited staff and need to prioritize. What should they do?

   • AInvestigate the DLP alert first because it is from Purview.
   • BInvestigate both alerts in Microsoft Defender XDR to see if they are related and prioritize accordingly.
   • CDisable both policies to prevent further alerts and then investigate.
   • DInvestigate the file policy alert first because it is from Defender for Cloud Apps.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   The security team at Fabrikam receives a DLP alert in the Microsoft Purview portal indicating that a user attempted to share a file containing credit card numbers externally. The team needs to respond quickly and also track the alert in Microsoft Defender XDR. What should they do?

   • ADisable the DLP policy that generated the alert to prevent further alerts.
   • BOpen the alert in Purview, review the activity details, and then escalate it to Defender XDR for investigation.
   • CIgnore the Purview alert and create a custom detection rule in Defender XDR to catch similar sharing attempts.
   • DUse eDiscovery to search for the file and then delete it from the user's OneDrive.
   Reveal Solution Discussion Select an answer first