Describe Insider Risk, eDiscovery, and Audit Capabilities in Microsoft Purview SC-900 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company wants to detect employees who are downloading large volumes of files from SharePoint before leaving the company. They have enabled audit logging and want to use Insider Risk Management. Which policy template should they use?

   • AData leaks
   • BDeparting employees
   • CSecurity policy violations
   • DData theft
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization is facing a regulatory investigation and must produce all communications related to a specific product launch. The legal team needs to search across email, Teams, and SharePoint, and then review the results in a single interface. What should they use?

   • AMicrosoft Purview Insider Risk Management to identify users who discussed the product.
   • BMicrosoft Purview Audit Log Search to find all activities related to the product launch.
   • CMicrosoft Purview Data Loss Prevention to block sharing of product launch information.
   • DMicrosoft Purview eDiscovery (Standard) with a case and review set.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In Microsoft Purview insider risk management, what is the role of risk indicators?

   • AThey are the policies that define which users are monitored
   • BThey are the reports that summarize insider risk cases
   • CThey are the permissions required to access insider risk management
   • DThey are the specific activities that trigger alerts for potential insider threats
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has a small compliance team and limited budget. They want to detect insider threats but cannot afford to monitor all users. They have identified a high-risk group of employees who have access to sensitive data. They also want to minimize false positives. What is the most effective approach in Microsoft Purview?

   • AUse Content Search to periodically search for sensitive data access and review the results.
   • BEnable audit logging and manually review all user activities for potential insider threats.
   • CCreate insider risk policies scoped to the high-risk group with specific indicators relevant to their data access patterns.
   • DCreate a single insider risk policy for all users and rely on alert review to filter out false positives.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial services firm wants to use Insider Risk Management to detect employees who might be stealing client data before they leave the company. The compliance team has enabled the required audit logging. Which set of indicators should they prioritize in their insider risk policy?

   • ASending internal emails with attachments and scheduling meetings with external vendors.
   • BDownloading large volumes of files from SharePoint, printing sensitive documents, and accessing files outside normal working hours.
   • CViewing their own HR records and checking their accrued vacation balance.
   • DChanging a user's password and updating their personal profile information.
   Reveal Solution Discussion Select an answer first