SC-401 Question #73: Real Exam Question with Answer & Explanation

Question

You have a Microsoft 365 E5 subscription. You plan to use Microsoft Purview insider risk management. You need to create an insider risk management policy that will detect data theft from Microsoft SharePoint Online by users that submitted their resignation or are near their employment termination date. What should you do first?

Options

• AConfigure Office indicators.
• BConfigure an HR data connector.
• CConfigure a Physical badging connector.
• DOnboard devices to Microsoft Defender for Endpoint.

Explanation

{"question_number": 5, "question_summary": "Prerequisite for insider risk policy detecting data theft by departing employees", "correct_answer": "B", "explanation": "To detect data theft correlated with resignation or upcoming employment termination, Microsoft Purview Insider Risk Management must know which users have submitted resignations or have termination dates approaching. This HR context is provided by configuring an HR data connector (option B), which imports employee data (including resignation dates and termination dates) from an HR system into Microsoft 365. Without this HR signal, the policy cannot identify which users are 'departing' and cannot trigger the correct risk indicators. Office indicators (A) and device onboarding (D) are relevant to other policy types or later steps, and the physical badging connector (C) is unrelated to this scenario.", "generated_by": "claude-sonnet", "llm_judge_score": 4}

No community discussion yet for this question.