Microsoft - SC-401: Administering Information Security in Microsoft 365

Sample Questions

Explanation:

Policy timeframes in Microsoft Purview Insider Risk Management allow you to define past and future review periods that are triggered after policy matches based on events and activities for the insider risk management policy templates. Depending on the policy template you choose, the following policy timeframes are available:

• Activation window: Available for all policy templates, Activation window is the defined number of days that the window activates after a triggering event. The window activates for 1 to 30 days after a triggering event occurs for any user assigned to the policy. For example, you've configured an insider risk management policy and set Activation window to 30 days. Several months have passed since you configured the policy, and a triggering event occurs for one of the users included in the policy. The triggering event activates Activation window and the policy is active for that user for 30 days after the triggering event occurred.

• Past activity detection: Available for all policy templates, Past activity detection is the defined number of days that the window activates before a triggering event. For activities in the audit log, the window activates for 0 to 90 days before a triggering event occurs for any user assigned to the policy. For example, you've configured an insider risk management policy and set Past activity detection to 90 days. Several months have passed since you configured the policy, and a triggering event occurs for one of the users included in the policy. The triggering event activates Past activity detection and the policy gathers historic activities for that user for 90 days prior to the triggering event.

References:

Investigate insider risk management activities

Set policy timeframes in insider risk management

Explanation:

We should configure a mail flow rule as shown below.

Reference: Message encryption

• Are delivered to both user1@contoso.com and user2@contoso.com
• Are sent from a user account that has a name that starts with the word Compliance

Explanation:

Boolean search operators, such as AND, OR, and NOT, help you define more-precise searches by including or excluding specific words in the search query. Other techniques, such as using property operators (such as >= or ..), quotation marks, parentheses, and wildcards, help you refine a search query. The following table lists the operators that you can use to narrow or broaden search results.

The Boolean operators AND, OR, NOT, and NEAR must be uppercase. A space between two keywords or two property:value expressions is the same as using OR. For example, from:"Sara Davis" subject:reorganization returns all messages sent by Sara Davis or messages that contain the word reorganization in the subject line.

Reference: Keyword queries and search conditions for eDiscovery

Explanation:

When you enable Microsoft Purview Insider Risk Management analytics, you get several important benefits. You can:

• Evaluate potential insider risks in your organization without configuring any insider risk policies.
• Get real-time guidance on configuring indicator threshold settings.
• Generate insider risk severity and user activity summary for the users not part of policies. Share this summary information with Data Loss Prevention, Communication Compliance, and Microsoft Defender.

To receive real-time recommendations on configuring indicator thresholds for your insider risk management policy (Policy1), you must first enable analytics in Microsoft Purview Insider Risk Management. This feature scans user activity and provides guidance on threshold settings, even before any policies are applied.

Reference: Use real-time analytics recommendations to set thresholds

Explanation:

The first step is to prepare the search results for exporting. When you prepare results, they're uploaded to a Microsoft-provided Azure Storage location in the Microsoft cloud. Content from mailboxes and sites is uploaded at a maximum rate of 2 GB per hour.

The exported search results must be downloaded within 14 days after you created the export job. When configuring the export job you are provided an export key which must be pasted in the eDiscovery Export Tool when downloading the results.

Reference: Export Content search results