Describe Insider Risk, eDiscovery, and Audit Capabilities in Microsoft Purview SC-900 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary purpose of insider risk management in Microsoft Purview?

   • ATo automatically encrypt all sensitive emails sent outside the organization
   • BTo manage user access permissions across Microsoft 365 services
   • CTo identify, analyze, and respond to potential security risks posed by users within an organization
   • DTo block all external threats before they reach the corporate network
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A compliance officer needs to find all emails and documents that contain a specific client's name and were created in the last six months. The search must include Exchange Online mailboxes, SharePoint Online sites, and OneDrive accounts. The compliance officer is not part of a specific eDiscovery case. What should they use in Microsoft Purview?

   • AAudit Log Search to find activities related to the client's name.
   • BCreate an eDiscovery (Premium) case and add all users as custodians.
   • CContent Search in the Microsoft Purview compliance portal.
   • DUse the Microsoft 365 Defender portal to search for the client's name in emails and files.
   Reveal Solution Discussion Select an answer first
4. 38expert · medium

   A security team is investigating a potential data breach. They need to determine whether a user accessed a sensitive file and then sent it externally. They have Microsoft 365 E5 licenses. They also need to retain audit records for six years to meet regulatory requirements. What should they do?

   • AEnable Advanced Audit, search the audit log for file access and email send events, and configure a custom audit log retention policy for six years.
   • BUse standard audit logging and search the audit log for the events, relying on the default 90-day retention.
   • CUse Insider Risk Management to detect the activity and export the audit log to a third-party SIEM for six years.
   • DRun a Content Search for the file and email, and place a hold on the user's mailbox.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which Microsoft Purview solution is designed to help organizations find content that may be relevant to a legal case?

   • AAudit logging
   • BeDiscovery
   • CInsider risk management
   • DData loss prevention
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company's compliance team needs to track when users access sensitive files in SharePoint Online and when administrators change permissions in the Microsoft 365 admin center. They want to be able to search these activities for the past 90 days. What should they configure in Microsoft Purview?

   • AEnable insider risk policies to detect file access and permission changes.
   • BConfigure eDiscovery cases to track user and admin activities.
   • CUse Content Search to find files that have been accessed and permissions that have been changed.
   • DEnable audit logging and use Audit Log Search to query for file access and admin permission changes.
   Reveal Solution Discussion Select an answer first