A file policy alert is generated in Microsoft Defender for Cloud Apps when a user downloads a large number of files from a SharePoint site and uploads them to a personal Dropbox account. The security team needs to respond to this alert. What is the most appropriate action to take?

Ignore the alert because it is a false positive, as the user is a trusted employee.

Create a new DLP policy in Microsoft Purview to block the user's access to Dropbox.

Use Activity Explorer to review the user's activities and then manually block the user's account.

Investigate the alert in Defender for Cloud Apps, review the user's activity, and then take action such as suspending the user or the app.

When investigating a suspicious file download, which record type would you search in the Purview Audit solution?

Azure Active Directory admin events

What is the benefit of managing Purview alerts in Microsoft Defender XDR?

Replacement for all compliance policies

Automatic deletion of audit logs

Centralized visibility and response across security signals

Guaranteed prevention of all data breaches

Microsoft Certified:Information Security Administrator Associate

Domain 3Objective 2

Manage Information Security Alerts and Activities SC-401 Practice Questions (Page 8)

Part of the Manage risks, alerts, and activities domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

9concepts

30–35%of the exam

Questions 36–38

36application · medium
A file policy alert is generated in Microsoft Defender for Cloud Apps when a user downloads a large number of files from a SharePoint site and uploads them to a personal Dropbox account. The security team needs to respond to this alert. What is the most appropriate action to take?
Select an answer first
37foundation · easy
When investigating a suspicious file download, which record type would you search in the Purview Audit solution?
Select an answer first
38foundation · easy
What is the benefit of managing Purview alerts in Microsoft Defender XDR?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SC-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.

Manage Information Security Alerts and Activities SC-401 Practice Questions (Page 8)

Questions 36–38

A file policy alert is generated in Microsoft Defender for Cloud Apps when a user downloads a large number of files from a SharePoint site and uploads them to a personal Dropbox account. The security team needs to respond to this alert. What is the most appropriate action to take?

When investigating a suspicious file download, which record type would you search in the Purview Audit solution?

What is the benefit of managing Purview alerts in Microsoft Defender XDR?

Keep studying — Manage risks, alerts, and activities