SC-401 · Question #195
You have a Microsoft 365 subscription. You configure a Microsoft Purview insider risk management policy named Policy1. You need to ensure that you will receive real-time recommendations on how to…
The correct answer is D. Enable insider risk management analytics. Enabling Insider Risk Management analytics is the prerequisite step for receiving real-time threshold recommendations. Once enabled, the analytics engine scans your Microsoft 365 audit logs and Endpoint DLP telemetry for the past 10 days of user activity and uses that data to…
Question
You have a Microsoft 365 subscription. You configure a Microsoft Purview insider risk management policy named Policy1. You need to ensure that you will receive real-time recommendations on how to configure the indicator thresholds for Policy1. The solution must ensure that the recommendations are based on a user's activity from the past 10 days. What should you do first?
Options
- ACreate an Insider Risk Indicators connector.
- BConfigure the Insider Risk Management Data sharing settings.
- CCreate a data loss prevention (DLP) policy
- DEnable insider risk management analytics.
How the community answered
(23 responses)- A9% (2)
- B4% (1)
- C4% (1)
- D83% (19)
Explanation
Enabling Insider Risk Management analytics is the prerequisite step for receiving real-time threshold recommendations. Once enabled, the analytics engine scans your Microsoft 365 audit logs and Endpoint DLP telemetry for the past 10 days of user activity and uses that data to suggest optimal indicator thresholds during policy configuration. Without analytics being turned on first, the recommendation engine has no data to work from. The other options - an Insider Risk Indicators connector, Data sharing settings, or a DLP policy - do not produce threshold recommendations and are not the correct first step.
Topics
Community Discussion
No community discussion yet for this question.