SC-401 Free Practice Questions — Page 9

Question 82

You have a Microsoft 365 subscription that contains the devices shown in the following table. From which devices can Microsoft Purview Insider Risk Management capture forensic evidence?

Question 83

DRAG DROP You have a Microsoft 365 5 subscription that uses Microsoft Purview insider risk management and contains three users named User1, User2, and User3. All insider risk management policies have adaptive protection enabled and the default conditions for insider risk levels configured. The users perform the following activities, which trigger insider risk policy alerts: • User1 performs at least one data exfiltration activity that results in a high severity risk score. • User2 performs at least three risky user activities within seven days, that each results in a high severity risk score. • User3 performs at least two data exfiltration activities within seven days, that each results in a high severity risk score. Which insider risk level is assigned to each user? To answer, drag the appropriate levels to the correct users. Each level may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Question 84

You have a Microsoft 365 E5 tenant. You create a data loss prevention (DLP) policy. You need to ensure that the policy protects documents in Microsoft Teams chat sessions. Which location should you enable in the policy?

Question 85

SIMULATION Username and password Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and select the username below. To enter your password, place your cursor in the Enter password box and select the password below. Microsoft 365 Username: Microsoft 365 Password: XXXXXXXXX If the Microsoft Edge browser or Microsoft 365 portal does not load successfully, select the Microsoft Edge browser icon from the task bar, type the URL “https://admin microsoft.com”, and press Enter. The following information is for technical support purposes only: Lab Instance: XXXXXXXX. Task 5 You need to ensure that a group named U.S. Sales can store files containing information subject to General Data Protection Regulation (GDPR) in their OneDrive accounts. All other current GDPR restrictions must remain in effect.

Question 86

You need to create a retention policy to delete content after seven years from the following locations: • Exchange Online email • SharePoint Online sites • OneDrive accounts • Microsoft 365 Groups • Teams channel messages • Teams chats What is the minimum number of retention policies that you should create?

Question 87

You are creating a DLP policy named Policy1 that will be applied to the locations as shown in the following exhibit. Policy1 contains an advanced data loss prevention (DLP) rule named Rule1. Which two conditions can you use in Rule1? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Question 88

You have a Microsoft 365 E5 subscription that contains a device named Device1. You need to enable Endpoint data loss prevention (Endpoint DLP) for Device1. What should you do first in the Microsoft Purview portal?

Question 89

HOTSPOT You have a Microsoft 365 E5 subscription that uses Microsoft Purview. You need to perform a content search for email messages that meet the following requirements: • Are delivered to both and • Are sent from a user account that has a name that starts with the word Compliance How should you complete the query in the KQL editor? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 90

You have Microsoft 365 E5 tenant that uses Microsoft Teams and contains two users named User1 and User2. You create a data loss prevention (DLP) policy that is applied to the Teams chat and channel messages location for User1 and User2. Which Teams entities will have DLP protection?

Question 91

You need to provide a user with the ability to view data loss prevention (DLP) alerts in the Microsoft Purview portal. The solution must use the principle of least privilege. Which role should you assign to the user?