Describe Insider Risk, eDiscovery, and Audit Capabilities in Microsoft Purview SC-900 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following data sources can be searched using Content Search in Microsoft Purview?

   • AExchange Online mailboxes
   • BSQL Server database tables
   • CAzure Active Directory sign-in logs
   • DWindows Event Viewer logs
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A financial services firm is setting up insider risk policies. They want to detect employees who might be stealing client data before they leave the company. The compliance team has identified that employees often print client lists, download large amounts of data from the CRM, and email data to personal accounts before resigning. Which combination of risk indicators should the compliance team enable in their insider risk policy?

   • ASending emails with sensitive labels, forwarding calendar invites, and editing documents.
   • BPrinting, download of large files, and email to personal domains.
   • CSharing files with external users, deleting files, and accessing the CRM after hours.
   • DAccessing the CRM, printing documents, and downloading files from SharePoint.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a typical activity performed within an eDiscovery case in Microsoft Purview?

   • APlacing a hold on content sources to preserve data
   • BCreating data loss prevention policies
   • CManaging user licenses
   • DConfiguring insider risk indicators
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A compliance officer needs to find all emails and documents that contain a specific phrase related to a regulatory investigation. The search must include Exchange Online, SharePoint Online, and OneDrive for Business. The compliance officer does not need to place holds or manage custodians. What is the most appropriate tool in Microsoft Purview?

   • AUse Microsoft 365 Defender to search for the phrase in emails and files.
   • BCreate an eDiscovery (Standard) case and search within the case.
   • CUse Audit Log Search to find activities related to the phrase.
   • DContent Search in the Microsoft Purview compliance portal.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has a high rate of false positives in their insider risk alerts. The compliance team has been spending too much time investigating alerts that turn out to be benign. They want to reduce the noise while still detecting real risks. They have identified that most false positives come from users who frequently share files with external partners as part of their normal job. What should they do?

   • AIncrease the alert volume by adding more indicators to the policy.
   • BUse Content Search to manually review all external sharing activities.
   • CDisable insider risk management entirely to avoid false positives.
   • DRefine the insider risk policy to exclude the specific external sharing indicators that are part of normal job functions.
   Reveal Solution Discussion Select an answer first