Describe Insider Risk, eDiscovery, and Audit Capabilities in Microsoft Purview SC-900 Practice Questions (Page 10)

Questions 46–48

1. 46foundation · easy

   Which of the following is an example of a risk indicator used in Microsoft Purview insider risk management?

   • AA user updating their profile photo in Microsoft Teams
   • BA user downloading a large number of files from SharePoint Online
   • CA user changing their desktop wallpaper
   • DA user sending a meeting invitation to a colleague
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A legal team is preparing for a complex litigation case involving multiple custodians and data sources. They need to collect evidence, place holds on custodians' data, and perform iterative searches to narrow down relevant content. The team also needs to review and tag documents for relevance. What should they use in Microsoft Purview?

   • AContent Search with export to a local folder for manual review.
   • BeDiscovery (Standard) with custodian management and holds.
   • CInsider Risk Management to monitor the custodians' activities during the investigation.
   • DeDiscovery (Premium) with custodian management, holds, and review sets.
   Reveal Solution Discussion Select an answer first
3. 48expert · hard

   An organization is required to provide audit logs for a regulatory investigation covering the past 3 years. They currently have standard audit logging enabled. They also need to prove that they have been monitoring for specific high-risk activities, such as accessing sensitive data from unusual locations. The compliance team wants to meet these requirements with the least amount of configuration effort. What should they do?

   • AKeep standard audit logging and export all logs to a third-party SIEM for 3-year retention and monitoring.
   • BCreate an insider risk policy to monitor high-risk activities and retain audit logs for 3 years.
   • CEnable Advanced Audit and configure a 3-year retention policy for audit logs, then use Audit Log Search to demonstrate monitoring of high-risk activities.
   • DEnable standard audit logging and use Content Search to find high-risk activities.
   Reveal Solution Discussion Select an answer first