Describe Insider Risk, eDiscovery, and Audit Capabilities in Microsoft Purview SC-900 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A compliance officer needs to search for all content related to a specific project across Exchange Online, SharePoint Online, and OneDrive for Business. The search results will be used as evidence in a legal case. The legal team requires that the content be preserved and that the search be repeatable. The compliance officer is not sure if more custodians will be added later. What should they do?

   • AUse Audit Log Search to find all activities related to the project and preserve the logs.
   • BCreate an eDiscovery (Standard) case, perform the search within the case, and place holds on the data sources.
   • CCreate an insider risk policy to monitor the project-related activities and preserve the data.
   • DUse Content Search to find the content and export the results to a PST file for preservation.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A multinational corporation is required by regulators to retain audit logs for 7 years. They also need to detect when users access sensitive files from unusual geographic locations. The compliance team has standard audit logging enabled. They need to meet the retention requirement and the detection requirement with minimal administrative overhead. What should they do?

   • ACreate an insider risk policy to detect unusual location access and retain audit logs for 7 years.
   • BEnable Advanced Audit, configure a 7-year retention policy for audit logs, and use Audit Log Search to query for unusual location access events.
   • CEnable standard audit logging and use Content Search to find unusual location access events.
   • DKeep standard audit logging and export all logs to a third-party SIEM for 7-year retention and unusual location detection.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the first step when creating an insider risk policy in Microsoft Purview?

   • AChoose a policy template
   • BSet the policy priority
   • CAssign reviewers to the policy
   • DDefine the risk indicators
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A company is investigating a security incident. They need to determine whether a user accessed a sensitive file and then attempted to delete it. They have Microsoft 365 E5 licenses. They also need to retain audit records for three years for compliance. What should they do?

   • AEnable Advanced Audit, search the audit log for file access and deletion events, and configure a custom audit log retention policy for three years.
   • BRun a Content Search for the file and place a hold on the user's mailbox.
   • CUse standard audit logging and search the audit log for the events, relying on the default 90-day retention.
   • DUse Insider Risk Management to detect the activity and export the audit log to a third-party SIEM for three years.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has a small compliance team and a limited budget. They want to detect insider threats but cannot afford to monitor all users. They have identified a high-risk group of employees who have access to sensitive data. They also want to minimize false positives. What is the most effective approach in Microsoft Purview?

   • AEnable audit logging and manually review all user activities for potential insider threats.
   • BCreate a single insider risk policy for all users and rely on alert review to filter out false positives.
   • CUse Content Search to periodically search for sensitive data access and review the results.
   • DCreate insider risk policies scoped to the high-risk group with specific indicators relevant to their data access patterns.
   Reveal Solution Discussion Select an answer first