Describe Insider Risk, eDiscovery, and Audit Capabilities in Microsoft Purview SC-900 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a key benefit of Advanced Audit in Microsoft Purview?

   • AIt eliminates the need for eDiscovery
   • BIt provides real-time alerts for insider threats
   • CIt provides access to high-value events that are not available in standard audit
   • DIt automatically blocks malicious user activities
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which component of insider risk management in Microsoft Purview is used to define the specific behaviors that trigger an alert?

   • AeDiscovery cases
   • BAudit logs
   • CRisk indicators
   • DData loss prevention policies
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A large enterprise organization is under regulatory scrutiny and needs to provide evidence of all user and admin activities for the past two years. They also need to detect potential data exfiltration by users accessing files from unusual locations. What should they configure in Microsoft Purview to meet both requirements?

   • AEnable Advanced Audit and configure the required retention policies for two years, then use Audit Log Search with advanced queries.
   • BEnable standard audit logging and export all logs to a third-party SIEM for long-term storage.
   • CCreate an insider risk policy to monitor all user activities and retain the data for two years.
   • DUse Content Search to find all user and admin activities for the past two years.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary function of Content Search in Microsoft Purview?

   • ATo automatically apply retention labels to content
   • BTo monitor user login attempts
   • CTo block malicious files from being downloaded
   • DTo search for content across Microsoft 365 services using keywords and conditions
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In Microsoft Purview insider risk management, what is the purpose of assigning users to an insider risk policy?

   • ATo specify which users' activities will be monitored by the policy
   • BTo designate which users can approve policy changes
   • CTo notify those users when they trigger a risk alert
   • DTo grant those users access to the insider risk management dashboard
   Reveal Solution Discussion Select an answer first