SC-400 Insider Risk Management 4

Question 1

Which Insider Risk Management feature allows an investigator to send a reminder or warning directly to a user whose behavior triggered an alert, without escalating to HR?

Accepted Answer

Notice templates

Answer

Notice templates allow investigators to send pre-written email notifications to users as a corrective action option directly from within a case.

Question 2

An Insider Risk Management policy is configured with the 'General data leaks' template. Which type of triggering event activates this policy for a user?

Accepted Answer

A high-severity DLP policy match

Answer

The 'General data leaks' template uses a high-severity DLP policy match as its default triggering event to begin monitoring a user.

Question 3

What does the 'risk score boosting' feature do in Insider Risk Management?

Accepted Answer

Temporarily increases the risk score for users with specific attributes like a privileged access level

Answer

Risk score boosting allows administrators to configure certain user attributes or sequences of activities to contribute an elevated weight to a user's overall risk score.

Question 4

An organization needs to investigate an insider risk case that may involve legal proceedings. Which feature ensures that case evidence is preserved appropriately?

Accepted Answer

Export case data to eDiscovery

Answer

Insider Risk Management cases can be escalated to eDiscovery (Premium) to place evidence on legal hold and support formal legal investigations.

Question 5

Which signal source is NOT natively supported as a risk indicator in Microsoft Purview Insider Risk Management?

Accepted Answer

Physical access badge data

Answer

Physical badge access data is not natively ingested by Insider Risk Management; only digital activity signals from Microsoft 365 and integrated connectors are supported.

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

SC-400 Insider Risk Management 4