Microsoft SC-401 Practice Test 35

Question 340

An IRM policy needs resignation dates from the human resources system for employee departure correlation. Which response most directly addresses the stated need?

Check HR connector health, field mapping, and latest imports.
Configure the supported Entra account-deletion trigger option.
Limit connector fields and policy access to approved minimum-required data.
Configure an approved Insider Risk Management HR connector.

Explanation

Correct Answer

D:

HR connectors supply supported employee lifecycle events used by relevant policy templates. It directly meets the case's requirement to ingest resignation and termination dates.

Incorrect Answers

A:

Missing lifecycle data prevents an HR-dependent policy from correlating employment events. That would repair an absent HR trigger feed; the question instead requires a way to ingest resignation and termination dates.

B:

Certain departing-user workflows can use identity deletion as an exit signal. That would trigger on Entra account deletion; the question instead requires a way to ingest resignation and termination dates.

C:

Data minimization and role control reduce exposure of employee information. That would govern HR data collection for IRM; the question instead requires a way to ingest resignation and termination dates.

Question 341

A policy is designed to start evaluating after an account's deletion in Microsoft Entra ID instead of an HR feed. Which configuration BEST meets the requirement?

Configure the supported Entra account-deletion trigger option.
Limit connector fields and policy access to approved minimum-required data.
Check HR connector health, field mapping, and latest imports.
Configure an approved Insider Risk Management HR connector.

Explanation

Correct Answer

A:

Certain departing-user workflows can use identity deletion as an exit signal. It directly meets the case's requirement to trigger on Entra account deletion.

Incorrect Answers

B:

Data minimization and role control reduce exposure of employee information. That would govern HR data collection for IRM; the question instead requires a way to trigger on Entra account deletion.

C:

Missing lifecycle data prevents an HR-dependent policy from correlating employment events. That would repair an absent HR trigger feed; the question instead requires a way to trigger on Entra account deletion.

D:

HR connectors supply supported employee lifecycle events used by relevant policy templates. That would ingest resignation and termination dates; the question instead requires a way to trigger on Entra account deletion.

Question 342

A risk policy has no matching departure events, and its HR import has been failing for two weeks. Which Microsoft Purview approach should the administrator choose?

Configure an approved Insider Risk Management HR connector.
Check HR connector health, field mapping, and latest imports.
Configure the supported Entra account-deletion trigger option.
Limit connector fields and policy access to approved minimum-required data.

Explanation

Correct Answer

B:

Missing lifecycle data prevents an HR-dependent policy from correlating employment events. It directly meets the case's requirement to repair an absent HR trigger feed.

Incorrect Answers

A:

HR connectors supply supported employee lifecycle events used by relevant policy templates. That would ingest resignation and termination dates; the question instead requires a way to repair an absent HR trigger feed.

C:

Certain departing-user workflows can use identity deletion as an exit signal. That would trigger on Entra account deletion; the question instead requires a way to repair an absent HR trigger feed.

D:

Data minimization and role control reduce exposure of employee information. That would govern HR data collection for IRM; the question instead requires a way to repair an absent HR trigger feed.

Question 343

A legal team needs to avoid collecting unnecessary employee details when using HR-driven policies. Which action most directly satisfies this requirement?

Configure an approved Insider Risk Management HR connector.
Check HR connector health, field mapping, and latest imports.
Limit connector fields and policy access to approved minimum-required data.
Configure the supported Entra account-deletion trigger option.

Explanation

Correct Answer

C:

Data minimization and role control reduce exposure of employee information. It directly meets the case's requirement to govern HR data collection for IRM.

Incorrect Answers

A:

HR connectors supply supported employee lifecycle events used by relevant policy templates. That would ingest resignation and termination dates; the question instead requires a way to govern HR data collection for IRM.

B:

Missing lifecycle data prevents an HR-dependent policy from correlating employment events. That would repair an absent HR trigger feed; the question instead requires a way to govern HR data collection for IRM.

D:

Certain departing-user workflows can use identity deletion as an exit signal. That would trigger on Entra account deletion; the question instead requires a way to govern HR data collection for IRM.

Question 344

Security wants a policy to score copies of sensitive files to removable drives on supported devices. What is the most appropriate next action?

Configure priority content or sites in the insider policy where supported.
Review and tune configured indicators and policy thresholds.
Enable the applicable browser or cloud exfiltration indicators and prerequisites.
Enable the relevant endpoint exfiltration indicators in Insider Risk Management.

Explanation

Correct Answer

D:

Indicator settings determine which supported device behaviors contribute to risk scoring. It directly meets the case's requirement to score removable-media exfiltration signals.

Incorrect Answers

A:

Priority content increases attention to activities involving designated sensitive assets. That would emphasize sensitive SharePoint assets; the question instead requires a way to score removable-media exfiltration signals.

B:

Explicit indicator selection and threshold tuning improve signal relevance. That would reduce noise from broad risk indicators; the question instead requires a way to score removable-media exfiltration signals.

C:

Selected indicators define which exfiltration activities are assessed by the policy. That would add cloud upload risk signals; the question instead requires a way to score removable-media exfiltration signals.

Question 345

An insider policy monitors SharePoint downloads but lacks any configured signal for risky uploads to unauthorized domains. Which response most directly addresses the stated need?

Enable the applicable browser or cloud exfiltration indicators and prerequisites.
Enable the relevant endpoint exfiltration indicators in Insider Risk Management.
Review and tune configured indicators and policy thresholds.
Configure priority content or sites in the insider policy where supported.

Explanation

Correct Answer

A:

Selected indicators define which exfiltration activities are assessed by the policy. It directly meets the case's requirement to add cloud upload risk signals.

Incorrect Answers

B:

Indicator settings determine which supported device behaviors contribute to risk scoring. That would score removable-media exfiltration signals; the question instead requires a way to add cloud upload risk signals.

C:

Explicit indicator selection and threshold tuning improve signal relevance. That would reduce noise from broad risk indicators; the question instead requires a way to add cloud upload risk signals.

D:

Priority content increases attention to activities involving designated sensitive assets. That would emphasize sensitive SharePoint assets; the question instead requires a way to add cloud upload risk signals.

Question 346

A high-risk policy must focus on a particular protected SharePoint site as priority content. Which configuration BEST meets the requirement?

Review and tune configured indicators and policy thresholds.
Configure priority content or sites in the insider policy where supported.
Enable the relevant endpoint exfiltration indicators in Insider Risk Management.
Enable the applicable browser or cloud exfiltration indicators and prerequisites.

Explanation

Correct Answer

B:

Priority content increases attention to activities involving designated sensitive assets. It directly meets the case's requirement to emphasize sensitive SharePoint assets.

Incorrect Answers

A:

Explicit indicator selection and threshold tuning improve signal relevance. That would reduce noise from broad risk indicators; the question instead requires a way to emphasize sensitive SharePoint assets.

C:

Indicator settings determine which supported device behaviors contribute to risk scoring. That would score removable-media exfiltration signals; the question instead requires a way to emphasize sensitive SharePoint assets.

D:

Selected indicators define which exfiltration activities are assessed by the policy. That would add cloud upload risk signals; the question instead requires a way to emphasize sensitive SharePoint assets.

Question 347

Risk scoring is excessively broad because many low-value activities are enabled by default. Which Microsoft Purview approach should the administrator choose?

Enable the applicable browser or cloud exfiltration indicators and prerequisites.
Configure priority content or sites in the insider policy where supported.
Review and tune configured indicators and policy thresholds.
Enable the relevant endpoint exfiltration indicators in Insider Risk Management.

Explanation

Correct Answer

C:

Explicit indicator selection and threshold tuning improve signal relevance. It directly meets the case's requirement to reduce noise from broad risk indicators.

Incorrect Answers

A:

Selected indicators define which exfiltration activities are assessed by the policy. That would add cloud upload risk signals; the question instead requires a way to reduce noise from broad risk indicators.

B:

Priority content increases attention to activities involving designated sensitive assets. That would emphasize sensitive SharePoint assets; the question instead requires a way to reduce noise from broad risk indicators.

D:

Indicator settings determine which supported device behaviors contribute to risk scoring. That would score removable-media exfiltration signals; the question instead requires a way to reduce noise from broad risk indicators.

Question 348

A risk review team should initially see pseudonymous user identifiers to limit investigator bias. Which action most directly satisfies this requirement?

Review supported administrative audit records for the settings change.
Use the approved IRM privacy setting and roles to reveal identities when justified.
Assign an appropriate IRM analyst or investigator role rather than full administration.
Keep Insider Risk Management anonymized usernames enabled.

Explanation

Correct Answer

D:

The solution is designed to pseudonymize user identity by default where configured. It directly meets the case's requirement to protect identity during initial triage.

Incorrect Answers

A:

Auditing helps establish accountability for privacy-sensitive configuration changes. That would trace an IRM privacy setting change; the question instead requires a way to protect identity during initial triage.

B:

Identity exposure is governed by the configured privacy mode and authorization model. That would reveal user identity under controls; the question instead requires a way to protect identity during initial triage.

C:

IRM role separation helps preserve least privilege and participant privacy. That would permit investigation without IRM policy editing; the question instead requires a way to protect identity during initial triage.

Question 349

An authorized investigator must reveal actual usernames for a permitted formal investigation. What is the most appropriate next action?

Use the approved IRM privacy setting and roles to reveal identities when justified.
Keep Insider Risk Management anonymized usernames enabled.
Assign an appropriate IRM analyst or investigator role rather than full administration.
Review supported administrative audit records for the settings change.

Explanation

Correct Answer

A:

Identity exposure is governed by the configured privacy mode and authorization model. It directly meets the case's requirement to reveal user identity under controls.

Incorrect Answers

B:

The solution is designed to pseudonymize user identity by default where configured. That would protect identity during initial triage; the question instead requires a way to reveal user identity under controls.

C:

IRM role separation helps preserve least privilege and participant privacy. That would permit investigation without IRM policy editing; the question instead requires a way to reveal user identity under controls.

D:

Auditing helps establish accountability for privacy-sensitive configuration changes. That would trace an IRM privacy setting change; the question instead requires a way to reveal user identity under controls.

Question 350

An auditor wants to confirm who changed Insider Risk Management privacy settings. Which response most directly addresses the stated need?

Use the approved IRM privacy setting and roles to reveal identities when justified.
Review supported administrative audit records for the settings change.
Keep Insider Risk Management anonymized usernames enabled.
Assign an appropriate IRM analyst or investigator role rather than full administration.

Explanation

Correct Answer

B:

Auditing helps establish accountability for privacy-sensitive configuration changes. It directly meets the case's requirement to trace an IRM privacy setting change.

Incorrect Answers

A:

Identity exposure is governed by the configured privacy mode and authorization model. That would reveal user identity under controls; the question instead requires a way to trace an IRM privacy setting change.

C:

The solution is designed to pseudonymize user identity by default where configured. That would protect identity during initial triage; the question instead requires a way to trace an IRM privacy setting change.

D:

IRM role separation helps preserve least privilege and participant privacy. That would permit investigation without IRM policy editing; the question instead requires a way to trace an IRM privacy setting change.

Pass Your Microsoft SC-401 Exam Easy!

Question 340

Explanation

Correct Answer

Incorrect Answers

Question 341

Explanation

Correct Answer

Incorrect Answers

Question 342

Explanation

Correct Answer

Incorrect Answers

Question 343

Explanation

Correct Answer

Incorrect Answers

Question 344

Explanation

Correct Answer

Incorrect Answers

Question 345

Explanation

Correct Answer

Incorrect Answers

Question 346

Explanation

Correct Answer

Incorrect Answers

Question 347

Explanation

Correct Answer

Incorrect Answers

Question 348

Explanation

Correct Answer

Incorrect Answers

Question 349

Explanation

Correct Answer

Incorrect Answers

Question 350

Explanation

Correct Answer

Incorrect Answers

Administering Information Security in Microsoft 365 (SC-401) Practice Tests