Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SC-400 > Communication Compliance, IRM and Priva > Flashcards

Communication Compliance, IRM and Priva Flashcards

1
Q

With which systems is Communication Compliance compatible?

A

Teams, Exchange, Viva and third-party sources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the purpose of Communication Compliance?

A

To ensure users communicate appropriately according to corporate policies, risk management and/or regulatory compliance such as FINRA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the 6 policy templates when creating a communication compliance policy?

A

Detect inappropriate text/image/content
Detect SIT
Detect financial regulatory compliance
Detect conflict of interest
Detect Copilot interactions
Custom

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the steps when creating a Communication Compliance policy?

A

1) Template
2) Users/groups and reviewers
3) Locations
4) Communication direction
5) Conditions
6) OCR ON/OFF
7) Review percentage
8) Filter email blast ON/OFF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

In which Purview solutions can cases can be escalated to an eDiscovery cases?

A

Communication Compliance
Insider Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which Purview solution can only be created in the portal and not in PowerShell?

A

Communication Compliance
Insider Risk Management
Privacy Risk Management
Data Subject Request
Trainable Classifiers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which portal should you use to disable the “Report inappropriate” option (which is enabled by default)?

A

Teams Admin Centre

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the two possible role groups that reviewers of Communication Compliance need to be assigned to?

A

Communication Compliance Analysts
Communication Compliance Investigators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

If you select a distribution list when creating a Communication Compliance policy, are the individual mailboxes of the members being scanned?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which Purview solutions require auditing to be turned on?

A

Sensitivity labels
Communication Compliance
Insider Risk Management
Information Barrier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are two functionalities that you can use to reduce the amount of alerts?

A

Filter
Duplicate analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the possible remediation actions for a communication compliance alert?

A

Resolve
False Positive
Notify
Escalate to ediscovery case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are some uses cases for Insider Risk Management?

A

Insider trading
Regulatory compliance violation
Data leakage
IP theft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the workflow for Insider Risk Management?

A
  1. Define policies
  2. Review and triage alerts
  3. Assign alerts to a case
  4. Investigate from case dashboard
  5. Escalate the case into a eDiscovery Premium case or with a SIEM service via the API
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the steps when creating an IRM policy?

A

Select template
Select Users/Groups
Content to prioritize (optional) based o location/classification
Triggering Event (e.g., DLP policy)
Indicators
Threshold before alert is triggered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which technologies does the Insider Risk Management reply on?

A

Microsoft Graph (API to access data from different systems)
Security services
Connector to HR services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the two policy templates available in IRM?

A

1) Data theft by departing users
2) Data leaks + by risk/priority users
3) Security policy violations + by departing/risky/priority users
4) Health record misuse
5) Risk browser usage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What should you do if you want to anonymize users in the alerts generated by IRM policies?

A

This is configured in the IRM general settings, that apply to all IRM policies, similar as policies timeframe and file type exclusions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How long does it take for audit to be effective after being turned on?

A

60 minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which role group is able to create, read, update, delete IRM policies, settings and role group assignments?

A

IRM Admin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which role group is able to access IRM alerts, cases and notice templates but not content search?

A

IRM Analyst

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which role group is able to access IRM alerts, cases and notice templates and content search?

A

IRM Investigator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the difference between the IRM Analyst and IRM Investigator role groups?

A

They can both access alerts, cases and notice templates, but only the Investigator can access content search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is one requirements before creating a IRM policy?

A

Turn on indicators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the possible status for an IRM alert?

A

Confirmed
Dismissed
Needs Review
Resolved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Is it possible to customize alert risk scores?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which role groups are assigned as permanent contributors by default to IRM cases?

A

IRM Analyst
IRM Investigator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the two types of contributors to an IRM case?

A

Permanent
Temporary (can be added by the Permanent ones)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the two roles that can access Content Explorer inside IRM and how are they different

A

Content Explorer List View (can only see the list of items and location)
Content Explorer Content View (can also access the actual content)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the possible resolution status a IRM case can take?

A

Benign
Confirmed policy violation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is Forensic Evidence functionality?

A

It enables visual activity capturing across devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the volume limitation of captured clips using Forensic evidence?

A

20GB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which Purview functionality requires dual authorization?

A

Forensic capture as part of IRM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which role group approves requests to use Forensic capture?

A

IRM Approver

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the steps to take before being able to enable Forensic evidence content capturing? (6)

A

1) Confirm subscription (special subscription on top of E5)
2) Add compliancedrive.microsoft.com
to allow list of firewall
3) Configure devices (onboard devices and have Purview client installed)
4) Define settings eg. bandwidth
5) Create a policy i.e., scope of capture
6) Dual authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which roles submit a request for Forensic evidence content capture?

A

IRM and IRM Admin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is Device Health Report?

A

It monitors health and status of devices configured for forensic evidences

31
Q

Which M365 service is not supported by Information Barrier, and what should you use instead?

A

Exchange, you should use mail flows

32
Q

What are segments in Information Barrier?

A

Set of groups or users defined using user account attributes such as job title, team, location

33
Q

How many segments can an organization define?

A

1000

34
Q

How many segments can one user be assigned to?

A

One unless you are in multiple-segment mode, then it is 10

35
Q

What are the modes that a Teams can take in Information Barrier?

A

Open
Implicit
Owner Moderated

36
Q

What are the modes that a OneDrive can take in Information Barrier?

A

Open
Owner Moderated
Explicit
Inferred

37
Q

What are the modes that a SharePoint site can take in Information Barrier?

A

Open
Implicit
Owner Moderated
Explicit

38
Q

What is the Open mode for Information Barrier? (Segment associated, sharing files and adding users)

A

When there are no associated segments, hence no IB applicable. This is the default for Teams/OD/SP created before enabling IB.
Segments: None and cannot be added
Sharing files: per the IB policy of the user
Adding user: any

39
Q

What is the Inferred mode for Information Barrier? (Segment associated, sharing files and adding users)

A

Segments associated: User’s segment and other segments that are compatible with the user’s segment and with each other. The Admin cannot associated any other.
Sharing files: Users whose segment match that of the site and unsegmented users
Adding users: N/A

40
Q

What is the Implicit mode for Information Barrier? (Segment associated, sharing files and adding users)

A

Segments associated: User segment and no other can be added
Sharing files: Existing members
Adding users: SP: only possible in Teams and Teams: if compatible

41
Q

What is the Owner Moderated mode for Information Barrier? (Segment associated, sharing files and adding users)

A

Segments associated: None and cannot be associated
Sharing files: Per the owner IB policy and for SharePoint with existing members
Adding users: Per the owner IB policy and for SharePoint with existing members

42
Q

What is the Explicit mode for Information Barrier? (Segment associated, sharing files and adding users)

A

Segments associated: User’s segment and for OneDrive: other segment compatible with the user’s and with each other. The admin can add other compatible segments.
Sharing files: Users whose segments match that of the site
Adding users: Users whose segments match that of the site

43
Q

Does Information Barrier support one-way blocking?

A

No

44
Q

What are the pre-requisite for the use of Information Barrier? (4)

A

1) Make sure that your organization’s structure is reflected in directory data
2) Enable scoped directory search in Microsoft Teams
3) Enable auditing
4) Provide administrator consent for Microsoft Teams by running some commands in Powershell

45
Q

How many IB policies can one segment have?

A

One

46
Q

What is the name of the service that determines whether a communication complies with IB policies?

A

Information Barrier Policy Evaluation Service

47
Q

What is the PowerShell command to enable IB for SharePoint and OneDrive?

A

run Set-SPOTenant -InformationBarrierSuspension $false

48
Q

What should you pay attention to when associating segments to OneDrive?

A

If you associate a segment to OneDrive of non-segmented users, they will lose access to their own OneDrive

49
Q

What is the PowerShell command to set a segment to a SharePoint or OneDrive?

A

Set-SPOSite -Identity -AddInformationSegment

50
Q

How many segments can be assigned to a SharePoint site?

A

Max 100

51
Q

What are the three types of policies in Priva Privacy Risk Management?

A

Data overexposure
Data transfer policies
Data minimisation

52
Q

What is the purpose of the data minimisation policy of Priva?

A

To identify and reduce the amount of unused personal data in the organisation

53
Q

What are the two functionalities of Microsoft Priva?

A

Privacy Risk Management
Data Subject Request

54
Q

What does the Data overexposure policy of Priva relies on?

A

1) Classification groups (that are groups of SITs)
2) SITs or trainable classifiers

55
Q

What are the minimum pieces of information you need to have to initiate a DSR?

A

First name
Last name
Email address

56
Q

How many days back does the Privacy Risk Management looks for?

A

30 days

57
Q

What are the steps to create a Privacy Risk Management policy?

A

Template
Data (based on SIT, trainable classifiers or classification groups)
Users/Groups
Locations
Conditions
Outcome
Alert
Mode (test/real)

58
Q

What are the status that a Privacy Risk Management policy can take?

A

On, Off and Testing

59
Q

When creating a Privacy Risk Management policy, what is the only location where you can select specific places within this location?

A

SharePoint, where you can specify the sites

60
Q

How long does it take for insights to appear on the “Overview” tab of Privacy Risk Management after turning on a policy?

A

Up to 48h

61
Q

What are possible remediation actions for a Privacy Risk Management issue? (6)

A

Notify the owner
Apply retention label
Apply sensitivity label
Mark as not match
Delete (for Data Minimisation policy issues)
Make private (for Data Transfer and Overexposure policy issues)

62
Q

What can you do with Privacy Risk Management alerts?

A

Create an issue out of

63
Q

What are the benefits of turning a Privacy Risk Management alert into an issue?

A

1) Review data, 2) remediate the issue, 3) add people as collaborators

64
Q

What are three ways to share a Privacy Risk Management issue with additional collaborators?

A

1) Secure Teams channel
2) Email
3) Link to the issue in Priva

65
Q

What are the four types of DSR?

A

1) Access (summary of the data subject’s personal information held by your organization)
2) Export
3) Get items that were tagged as follow-up during review process
4) Delete

66
Q

What is the workflow for DSR?

A

1) Create a search
2) Data estimate is generated in the “Data estimate” card in “Overview”
3) Data retrieval is performed
4) Review data from the “Data collected” tab
5) Generate a report
6) Download the reports from the “Reports” tab and share with data subject
7) Close

67
Q

For which reasons would you pause the DSR process between the data estimate and retrieval? (2)

A

1) If you defined this as part of settings
2) If the estimate yields more than 300K items or 300 GB of data,

68
Q

Where is the result of data retrieval as part of DSR being stored?

A

Azure Blob Storage container

69
Q

What can you do as part of the review of retrieved data in a DSR?

A

1) Import additional files
1) Mark items as to Include or Exclude
3) Tag items as Follow-up, Delete or Update
4) Redact data not linked to the data subject on documents containing data of multiple data subjects (e.g., add black boxes)

70
Q

What are the limitations when important additional files to a review set of a DSR?

A

Files must be less than 500MB each
Only one import at the time per user

71
Q

What is being created along with the data collection in a DSR?

A

A Teams channel, to facilitate the content review

72
Q

What is the suffit being added to redacted documents as part of DSR?

A

_burn.pdf

73
Q

How long does it take for DSR reports to be generated?

A

Up to 30min

74
Q

What does the generated DSR reports contain (in addition to the actual data)? (3)

A

1) Extracted text fields
2) Export load files (original file names, because the files are renamed to help protect personal data)
3) Summary

75
Q

What is the default retention period for DSR reports in Azure?

A

30 days from request closure

76
Q

What is the main difference between PAM in Purview and in Azure?

A

In Purview it is a task level
In Entra is it a role level

77
Q

What is the default duration of granted access in PAM following just-in-time concept?

A

4 hours

78
Q

What is the validity of an access request after submission?

A

24h

79
Q

What is the PAM process?

A

1) Create approver group
2) Enabled PAM with the default approver group
3) Create an access policy
4) Submit access policy request
5) Approving the access policy request?

80
Q

Where does the PAM process take place?

A

In O365 Admin Centre

81
Q

What is the purpose of Customer Lockbox?

A

It ensures that Microsoft engineers cannot access organization data without explicit approval by Microsoft manager and the customer

82
Q

What is the maximum duration of access granted to Microsoft engineers via Customer Lockbox?

A

4 hours

83
Q

What is the default duration of a Customer Lockbox request?

A

12 hours

84
Q

What is Adaptive Protection?

A

A preview feature that uses ML to identify and mitigate most critical risks. It allows the detection of “risky” users, than can the be used to fine-tune DLP and IRM policies.

SC-400 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions