SC-400 Insider Risk Management 3

Question 1

An administrator wants to ensure that only specific users can view the actual content of files in Insider Risk Management cases. Which role group should these users be assigned to?

Accepted Answer

Insider Risk Management Investigators

Answer

The Insider Risk Management Investigators role group grants access to all case management features including viewing file and email content in the content explorer.

Question 2

What is the function of 'cumulative exfiltration detection' in Insider Risk Management?

Accepted Answer

It identifies users who gradually move large volumes of data over time

Answer

Cumulative exfiltration detection identifies users whose total data movement over time exceeds normal baselines, even if individual events seem small.

Question 3

Which connector type must be deployed to allow Insider Risk Management to trigger alerts based on employee performance review data?

Accepted Answer

HR data connector

Answer

The HR data connector is used to import signals such as performance improvement plans and resignation dates from external HR systems.

Question 4

A company wants to reduce false positive alerts for a known group of executives who regularly move large files. Which Insider Risk Management feature should be configured?

Accepted Answer

Indicator thresholds

Answer

Adjusting indicator thresholds allows administrators to raise the sensitivity level required to trigger an alert, reducing false positives for users with legitimately high activity.

Question 5

In the context of Insider Risk Management, what is a 'triggering event'?

Accepted Answer

An activity that causes a user to enter the active monitoring window of a policy

Answer

A triggering event (such as a resignation date or a DLP policy match) is what activates a policy for a specific user and begins monitoring their activity.

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

SC-400 Insider Risk Management 3