A company wants to detect employees who are sending sensitive data to personal email accounts. They have enabled audit logging and want to use Insider Risk Management. Which indicator should they enable in their insider risk policy?

Accessing files outside normal working hours

Downloading files from SharePoint

Sending email to personal domains

What is the primary purpose of searching the audit log in Microsoft Purview?

To configure insider risk policies

To apply retention labels to content

To investigate specific user or admin activities

In Microsoft Purview eDiscovery, what is the purpose of creating an eDiscovery case?

To organize and manage searches, holds, and exports for a specific legal matter

To monitor user activities for insider threats

To automatically encrypt all data in the organization

To assign permissions to users for accessing Microsoft 365

An organization needs to prove to regulators that they have been monitoring for specific high-risk activities, such as accessing sensitive data from unusual locations. They also need to retain audit logs for 5 years. The compliance team wants to minimize administrative effort. What should they do?

Create an insider risk policy to monitor high-risk activities and retain audit logs for 5 years.

Enable standard audit logging and use Content Search to find high-risk activities.

Enable Advanced Audit, configure a 5-year retention policy, and use Audit Log Search to demonstrate monitoring of high-risk activities.

Keep standard audit logging and export all logs to a third-party SIEM for 5-year retention and monitoring.

A multinational company needs to investigate a potential insider threat. They must determine whether a user accessed a sensitive file and then sent it externally. They also need to retain audit records for five years to comply with local regulations. They have Microsoft 365 E5 licenses. What should they do?

Use standard audit logging and search the audit log for the events, relying on the default 90-day retention.

Use Insider Risk Management to detect the activity and export the audit log to a third-party storage for five years.

Run a Content Search for the file and email, and place a hold on the user's mailbox.

Enable Advanced Audit, search the audit log for file access and email send events, and configure a custom audit log retention policy for five years.

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 4Objective 4

Describe Insider Risk, eDiscovery, and Audit Capabilities in Microsoft Purview SC-900 Practice Questions (Page 6)

Part of the Describe the capabilities of Microsoft compliance solutions domain, which accounts for 20–25% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~4–8 in this domain), expect 1–2 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

9concepts

20–25%of the exam

Questions 26–30

26application · medium
A company wants to detect employees who are sending sensitive data to personal email accounts. They have enabled audit logging and want to use Insider Risk Management. Which indicator should they enable in their insider risk policy?
Select an answer first
27foundation · easy
What is the primary purpose of searching the audit log in Microsoft Purview?
Select an answer first
28foundation · easy
In Microsoft Purview eDiscovery, what is the purpose of creating an eDiscovery case?
Select an answer first
29expert · hard
An organization needs to prove to regulators that they have been monitoring for specific high-risk activities, such as accessing sensitive data from unusual locations. They also need to retain audit logs for 5 years. The compliance team wants to minimize administrative effort. What should they do?
Select an answer first
30expert · medium
A multinational company needs to investigate a potential insider threat. They must determine whether a user accessed a sensitive file and then sent it externally. They also need to retain audit records for five years to comply with local regulations. They have Microsoft 365 E5 licenses. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.