SC-400 Data Loss Prevention & Threat Protection 5

Question 1

Microsoft Purview Insider Risk Management uses which type of signals to detect potential data theft by a departing employee?

Accepted Answer

Behavioral signals such as file downloads, USB transfers, and HR departure indicators

Answer

Insider Risk Management correlates behavioral signals (file activity, HR data, network events) to identify risky patterns like data exfiltration by departing employees.

Question 2

What role is required to create and manage Insider Risk Management policies in Microsoft Purview?

Accepted Answer

Insider Risk Management or Insider Risk Management Admin role

Answer

The Insider Risk Management and Insider Risk Management Admin roles are specifically scoped for creating and managing insider risk policies.

Question 3

An organization wants to apply DLP policies to Power BI reports shared within the organization. Which license is required?

Accepted Answer

Microsoft 365 E5 Compliance or standalone Microsoft Purview DLP add-on

Answer

DLP for Power BI requires Microsoft 365 E5 Compliance or an equivalent standalone add-on license, as it extends beyond the standard E3 DLP coverage.

Question 4

A compliance team needs to investigate whether any sensitive files were uploaded to personal cloud storage (e.g., personal Dropbox) from corporate devices. Which Microsoft solution provides this visibility?

Accepted Answer

Microsoft Purview Activity Explorer filtered by endpoint DLP

Answer

Endpoint DLP logs file activity including uploads to cloud services, and Activity Explorer lets compliance teams filter and review these events.

Question 5

What is the function of 'Adaptive Protection' in Microsoft Purview?

Accepted Answer

It dynamically adjusts DLP policy strictness based on a user's insider risk level

Answer

Adaptive Protection integrates Insider Risk Management risk levels with DLP policies, applying stricter controls to users classified as elevated risk.

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

SC-400 Data Loss Prevention & Threat Protection 5