Microsoft - SC-401: Administering Information Security in Microsoft 365

Sample Questions

• Minimize the impact on users who are NOT part of the project.
• Minimize administrative effort.

Explanation:

Insider risk management includes support for assigning priority user groups to policies to help identify unique risk activities for user with critical positions, high levels of data and network access, or a past history of risk behavior. Creating a priority user group and assigning users to the group help scope policies to the unique circumstances presented by these users.

You can create a priority user group and assign users to the group to help you scope policies specific to the unique circumstances presented by these identified users. 

A priority user group is required when using the following policy templates:

• Security policy violations by priority users
• Data leaks by priority users

References:

Get started with insider risk management

Prioritize user groups for insider risk management policies

Explanation:

Microsoft Purview Data Security Posture Management (DSPM) for AI from the Microsoft Purview portal provides a central management location to help you quickly secure data for AI apps and proactively monitor AI use. These apps include Microsoft 365 Copilot, agents, other copilots from Microsoft, and AI apps from third-party large language modules (LLMs).

Data Security Posture Management for AI offers a set of capabilities so you can safely adopt AI without having to choose between productivity and protection:

• Insights and analytics into AI activity in your organization

• Ready-to-use policies to protect data and prevent data loss in AI prompts

• Data risk assessments to identify, remediate, and monitor potential oversharing of data.

• Compliance controls to apply optimal data handling and storing policies

As a prerequisite to track interactions between users and generative AI websites the devices must be onboarded to Microsoft Purview and the Microsoft Purview browser extension must be installed on the devices.

The Microsoft Purview browser extension enables tracking of user activities on web-based applications, including AI-related tools like ChatGPT, Microsoft Copilot, and other generative AI platforms. The browser extension is available for Chrome and Firefox and can be deployed to Windows and macOS devices. The browser extension is not required for native applications such as the Microsoft Edge browser.

References:

Microsoft Purview data security and compliance protections for generative AI apps

Get started with the Microsoft Purview extension for Chrome

Get started with the Microsoft Purview extension for Firefox

• In a new country, open an office named Office1.
• Create a new user named User1.
• Deploy insider risk management to Office1.
• Add User1 to the Insider Risk Management Admins role group.

Explanation:

Administrative units in Microsoft Entra ID allow you to restrict administrative permissions to specific parts of your Microsoft Entra organization. You create, delete, and edit administrative units in Microsoft Entra. In Microsoft Entra, you manage the users or groups that are members of the administrative unit. This feature lets you subdivide your organization into smaller units and assign specific administrators to manage only the members within those units. Microsoft Purview role groups allow you to assign admins to specific administrative units. Microsoft Purview solutions that support administrative unit will then restrict visibility and management permissions to the members of the unit.

For example, you could use administrative units to delegate permissions to administrators for each geographic region in a large multi-national organization, or for grouping administrator access by department within your organization. You can create region or department-specific policies or view user activity as a result of those policies and administrative unit assignment. You can also use administrative units as an initial scope for a policy, where the selection of users eligible for the policy depends on membership in administrative units.

Reference: Administrative units

• Deletes files that contain a sensitive information type (SIT) from their device.
• Copies files that contain a SIT to a USB drive.
• Prints files that contain a SIT.

Explanation:

Insider risk management policies determine which users are in-scope and which types of risk indicators are configured for alerts. You can quickly create a security policy that applies to all users in your organization or define individual users or groups for management in a policy. Policies support content priorities to focus policy conditions on multiple or specific Microsoft Teams, SharePoint sites, data sensitivity types, and data labels. Using templates, you can select specific risk indicators and customize event thresholds for policy indicators, effectively customizing risk scores, and level and frequency of alerts.

You must enable device monitoring and onboard your endpoints before you can monitor and protect sensitive items on a device. Both of these actions are done in the Microsoft Purview portal.

Onboarding Windows 10 or Windows 11 devices

1. he Microsoft Purview portal. Choose Settings > Device onboarding > Devices.

2. Choose Turn on device onboarding.

3. Choose Onboarding to begin the onboarding process.

4. Choose the way you want to deploy to these other devices from the Deployment method list and then download package.

5. Choose the appropriate procedure to follow from the table below:
   
   

References:

Onboard Windows devices into Microsoft 365 overview

Create and manage insider risk management policies

Explanation:

Microsoft Purview Insider Risk Management is a compliance solution that helps minimize internal risks by enabling you to detect, investigate, and act on malicious and inadvertent activities in your organization. Insider risk policies allow you to define the types of risks to identify and detect in your organization, including acting on cases and escalating cases to Microsoft eDiscovery (Premium) if needed.

The Microsoft Purview browser extension is a lightweight tool that integrates with Microsoft Purview‘s Data Loss Prevention (DLP) and Insider Risk Management (IRM) systems. It monitors browser activity, specifically focusing on actions that could expose sensitive data—such as frequent use of generative AI tools or the sharing of sensitive information in online forms. The Microsoft Purview browser extension does not log your entire browser history. It only tracks specific activities when a pre-defined policy is violated, such as visiting a high-risk site or uploading sensitive data into an AI tool.

We should deploy the Insider Risk Management Risky browser usage policy template which requires the Microsoft Purview extension as shown below.

References:

Learn about insider risk management

Learn about the Microsoft Purview extension for Chrome

Tags: exam, examcollection, exam simulation, exam questions, questions & answers, training course, study guide, vce, braindumps, practice test