Free Microsoft SC-401 Actual Exam Questions - Question 8 Discussion
You plan to use Microsoft Purview insider risk management.
You need to create an insider risk management policy that will detect data theft from Microsoft
SharePoint Online by users that submitted their resignation or are near their employment
termination date.
What should you do first?
A/D? You definitely need the HR data connector to mark the right users, but onboarding devices to Defender for Endpoint could help catch suspicious activity on those devices later. Still, first step is A for sure.
You gotta start with connecting HR data to identify users who resigned or are leaving, so A makes the most sense here. Without that, you can’t target the right people effectively. A
A/B? A for sure to get the user info from HR, but B might be needed next to track their SharePoint activity. Still, without A, you can’t filter users by resignation status.
Maybe D could be a consideration if you want to monitor devices closely, but it doesn’t really solve the part about identifying users who resigned or are about to leave. The core issue here is linking HR data to know who exactly to watch, so A still feels like the necessary first step. The other options seem more about detecting activity rather than defining which users to watch for insider risk based on their employment status. Without that connection, you can’t tailor the policy effectively.
A imo. Without linking HR data, you can’t flag users based on resignation or termination status, which is key here. The other options don’t address identifying those specific users first.
I think A makes sense since you need to identify users who resigned or are near termination first. Without that data, the policy can’t target the right people. Would B help if you don’t know who left?
It’s A, gotta set up the HR data connector first to track users’ employment status before policies kick in.