SC-400 Insider Risk Management 5

Question 1

Which setting in Insider Risk Management enables the system to detect risky browsing behavior such as visiting job search or competitor websites?

Accepted Answer

Risky browsing indicators

Answer

Risky browsing indicators, enabled via Microsoft Defender for Endpoint integration, detect visits to websites associated with job searching or other departure-related activities.

Question 2

An investigator needs to collaborate on an Insider Risk Management case with a colleague who does not have access to the compliance portal. What is the best approach?

Accepted Answer

Add the colleague to the appropriate Insider Risk Management role group

Answer

Granting access through the appropriate IRM role group (Analyst or Investigator) is the correct and secure method to enable portal collaboration.

Question 3

What is the purpose of configuring 'intelligent detections' in Insider Risk Management settings?

Accepted Answer

To exclude trusted domains and file types from triggering risk indicators

Answer

Intelligent detections settings allow administrators to define allowed domains and unallowed file type exclusions to reduce noise from legitimate business activities.

Question 4

A Compliance Administrator notices that the Insider Risk Management analytics page shows no data after being enabled. What is the most likely reason?

Accepted Answer

Audit logging has not been enabled for the tenant

Answer

Insider Risk Management analytics relies on the Microsoft 365 unified audit log; if audit logging is disabled, no activity data is available for analysis.

Question 5

When configuring an Insider Risk Management policy, what does the 'past activity detection' window control?

Accepted Answer

How far back historical activity is reviewed when a user first enters a policy's scope

Answer

The past activity detection window determines how many days of historical user activity are evaluated once a triggering event places a user in active monitoring.

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

SC-400 Insider Risk Management 5