nerdexam
Microsoft

MS-102 · Question #124

You need to notify the manager of the human resources department when a user in the department shares a file or folder from the department's Microsoft SharePoint site. What should you do?

The correct answer is D. From the Microsoft 365 Defender portal, create an alert policy. Option D is correct because Microsoft 365 Defender alert policies are designed specifically to monitor user activities - including file-sharing events - and trigger email notifications to designated recipients (like an HR manager) when those activities occur, with the ability…

Submitted by alyssa_d· Apr 18, 2026Manage security and threats by using Microsoft Defender XDR

Question

You need to notify the manager of the human resources department when a user in the department shares a file or folder from the department's Microsoft SharePoint site. What should you do?

Options

  • AFrom the SharePoint admin center, modify the sharing settings.
  • BFrom the SharePoint site, create an alert.
  • CFrom the Microsoft Purview compliance portal, create a data loss prevention (DLP) policy.
  • DFrom the Microsoft 365 Defender portal, create an alert policy.

How the community answered

(59 responses)
  • A
    15% (9)
  • B
    7% (4)
  • C
    3% (2)
  • D
    75% (44)

Explanation

Option D is correct because Microsoft 365 Defender alert policies are designed specifically to monitor user activities - including file-sharing events - and trigger email notifications to designated recipients (like an HR manager) when those activities occur, with the ability to scope the alert to a specific site or group of users.

Option A is wrong because SharePoint sharing settings control who is allowed to share (e.g., restricting external sharing), not whether a manager gets notified when sharing happens.

Option B is wrong because SharePoint site alerts notify the alert creator about content changes (edits, deletions), not about sharing actions performed by other users in the department.

Option C is wrong because DLP policies are used to prevent sensitive data from leaving the organization; they enforce compliance rules rather than simply notifying a manager of routine internal sharing.

Memory tip: Think of it as the "Defender = Detective" rule - the Microsoft 365 Defender portal is your go-to for watching and alerting on user activity, while Purview/DLP blocks bad behavior and SharePoint settings control permissions.

Topics

#SharePoint sharing#Microsoft 365 Defender#Activity alerts#Security monitoring

Community Discussion

No community discussion yet for this question.

Full MS-102 Practice