Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

SC-400 > Communication Compliance, IRM and Priva > Flashcards

Communication Compliance, IRM and Priva Flashcards

1
Q

With which systems is Communication Compliance compatible?

A

Teams, Exchange, Viva and third-party sources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the purpose of Communication Compliance?

A

To ensure users communicate appropriately according to corporate policies, risk management and/or regulatory compliance such as FINRA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the 6 policy templates when creating a communication compliance policy?

A

Detect inappropriate text/image/content
Detect SIT
Detect financial regulatory compliance
Detect conflict of interest
Detect Copilot interactions
Custom

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the steps when creating a Communication Compliance policy?

A

1) Template
2) Users/groups and reviewers
3) Locations
4) Communication direction
5) Conditions
6) OCR ON/OFF
7) Review percentage
8) Filter email blast ON/OFF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

In which Purview solutions can cases can be escalated to an eDiscovery cases?

A

Communication Compliance
Insider Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which Purview solution can only be created in the portal and not in PowerShell?

A

Communication Compliance
Insider Risk Management
Privacy Risk Management
Data Subject Request
Trainable Classifiers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which portal should you use to disable the “Report inappropriate” option (which is enabled by default)?

A

Teams Admin Centre

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the two possible role groups that reviewers of Communication Compliance need to be assigned to?

A

Communication Compliance Analysts
Communication Compliance Investigators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

If you select a distribution list when creating a Communication Compliance policy, are the individual mailboxes of the members being scanned?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which Purview solutions require auditing to be turned on?

A

Sensitivity labels
Communication Compliance
Insider Risk Management
Information Barrier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are two functionalities that you can use to reduce the amount of alerts?

A

Filter
Duplicate analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the possible remediation actions for a communication compliance alert?

A

Resolve
False Positive
Notify
Escalate to ediscovery case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are some uses cases for Insider Risk Management?

A

Insider trading
Regulatory compliance violation
Data leakage
IP theft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the workflow for Insider Risk Management?

A
  1. Define policies
  2. Review and triage alerts
  3. Assign alerts to a case
  4. Investigate from case dashboard
  5. Escalate the case into a eDiscovery Premium case or with a SIEM service via the API
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the steps when creating an IRM policy?

A

Select template
Select Users/Groups
Content to prioritize (optional) based o location/classification
Triggering Event (e.g., DLP policy)
Indicators
Threshold before alert is triggered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which technologies does the Insider Risk Management reply on?

A

Microsoft Graph (API to access data from different systems)
Security services
Connector to HR services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the two policy templates available in IRM?

A

1) Data theft by departing users
2) Data leaks + by risk/priority users
3) Security policy violations + by departing/risky/priority users
4) Health record misuse
5) Risk browser usage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What should you do if you want to anonymize users in the alerts generated by IRM policies?

A

This is configured in the IRM general settings, that apply to all IRM policies, similar as policies timeframe and file type exclusions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How long does it take for audit to be effective after being turned on?

A

60 minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which role group is able to create, read, update, delete IRM policies, settings and role group assignments?

A

IRM Admin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which role group is able to access IRM alerts, cases and notice templates but not content search?

A

IRM Analyst

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which role group is able to access IRM alerts, cases and notice templates and content search?

A

IRM Investigator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the difference between the IRM Analyst and IRM Investigator role groups?

A

They can both access alerts, cases and notice templates, but only the Investigator can access content search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is one requirements before creating a IRM policy?

A

Turn on indicators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
What are the possible status for an IRM alert?
Confirmed Dismissed Needs Review Resolved
22
Is it possible to customize alert risk scores?
No
22
Which role groups are assigned as permanent contributors by default to IRM cases?
IRM Analyst IRM Investigator
22
What are the two types of contributors to an IRM case?
Permanent Temporary (can be added by the Permanent ones)
23
What are the two roles that can access Content Explorer inside IRM and how are they different
Content Explorer List View (can only see the list of items and location) Content Explorer Content View (can also access the actual content)
23
What are the possible resolution status a IRM case can take?
Benign Confirmed policy violation
24
What is Forensic Evidence functionality?
It enables visual activity capturing across devices
25
What is the volume limitation of captured clips using Forensic evidence?
20GB
26
Which Purview functionality requires dual authorization?
Forensic capture as part of IRM
27
Which role group approves requests to use Forensic capture?
IRM Approver
28
What are the steps to take before being able to enable Forensic evidence content capturing? (6)
1) Confirm subscription (special subscription on top of E5) 2) Add compliancedrive.microsoft.com to allow list of firewall 3) Configure devices (onboard devices and have Purview client installed) 4) Define settings eg. bandwidth 5) Create a policy i.e., scope of capture 6) Dual authorization
29
Which roles submit a request for Forensic evidence content capture?
IRM and IRM Admin
30
What is Device Health Report?
It monitors health and status of devices configured for forensic evidences
31
Which M365 service is not supported by Information Barrier, and what should you use instead?
Exchange, you should use mail flows
32
What are segments in Information Barrier?
Set of groups or users defined using user account attributes such as job title, team, location
33
How many segments can an organization define?
1000
34
How many segments can one user be assigned to?
One unless you are in multiple-segment mode, then it is 10
35
What are the modes that a Teams can take in Information Barrier?
Open Implicit Owner Moderated
36
What are the modes that a OneDrive can take in Information Barrier?
Open Owner Moderated Explicit Inferred
37
What are the modes that a SharePoint site can take in Information Barrier?
Open Implicit Owner Moderated Explicit
38
What is the Open mode for Information Barrier? (Segment associated, sharing files and adding users)
When there are no associated segments, hence no IB applicable. This is the default for Teams/OD/SP created before enabling IB. Segments: None and cannot be added Sharing files: per the IB policy of the user Adding user: any
39
What is the Inferred mode for Information Barrier? (Segment associated, sharing files and adding users)
Segments associated: User's segment and other segments that are compatible with the user's segment and with each other. The Admin cannot associated any other. Sharing files: Users whose segment match that of the site and unsegmented users Adding users: N/A
40
What is the Implicit mode for Information Barrier? (Segment associated, sharing files and adding users)
Segments associated: User segment and no other can be added Sharing files: Existing members Adding users: SP: only possible in Teams and Teams: if compatible
41
What is the Owner Moderated mode for Information Barrier? (Segment associated, sharing files and adding users)
Segments associated: None and cannot be associated Sharing files: Per the owner IB policy and for SharePoint with existing members Adding users: Per the owner IB policy and for SharePoint with existing members
42
What is the Explicit mode for Information Barrier? (Segment associated, sharing files and adding users)
Segments associated: User's segment and for OneDrive: other segment compatible with the user's and with each other. The admin can add other compatible segments. Sharing files: Users whose segments match that of the site Adding users: Users whose segments match that of the site
43
Does Information Barrier support one-way blocking?
No
44
What are the pre-requisite for the use of Information Barrier? (4)
1) Make sure that your organization's structure is reflected in directory data 2) Enable scoped directory search in Microsoft Teams 3) Enable auditing 4) Provide administrator consent for Microsoft Teams by running some commands in Powershell
45
How many IB policies can one segment have?
One
46
What is the name of the service that determines whether a communication complies with IB policies?
Information Barrier Policy Evaluation Service
47
What is the PowerShell command to enable IB for SharePoint and OneDrive?
run Set-SPOTenant -InformationBarrierSuspension $false
48
What should you pay attention to when associating segments to OneDrive?
If you associate a segment to OneDrive of non-segmented users, they will lose access to their own OneDrive
49
What is the PowerShell command to set a segment to a SharePoint or OneDrive?
Set-SPOSite -Identity -AddInformationSegment
50
How many segments can be assigned to a SharePoint site?
Max 100
51
What are the three types of policies in Priva Privacy Risk Management?
Data overexposure Data transfer policies Data minimisation
52
What is the purpose of the data minimisation policy of Priva?
To identify and reduce the amount of unused personal data in the organisation
53
What are the two functionalities of Microsoft Priva?
Privacy Risk Management Data Subject Request
54
What does the Data overexposure policy of Priva relies on?
1) Classification groups (that are groups of SITs) 2) SITs or trainable classifiers
55
What are the minimum pieces of information you need to have to initiate a DSR?
First name Last name Email address
56
How many days back does the Privacy Risk Management looks for?
30 days
57
What are the steps to create a Privacy Risk Management policy?
Template Data (based on SIT, trainable classifiers or classification groups) Users/Groups Locations Conditions Outcome Alert Mode (test/real)
58
What are the status that a Privacy Risk Management policy can take?
On, Off and Testing
59
When creating a Privacy Risk Management policy, what is the only location where you can select specific places within this location?
SharePoint, where you can specify the sites
60
How long does it take for insights to appear on the "Overview" tab of Privacy Risk Management after turning on a policy?
Up to 48h
61
What are possible remediation actions for a Privacy Risk Management issue? (6)
Notify the owner Apply retention label Apply sensitivity label Mark as not match Delete (for Data Minimisation policy issues) Make private (for Data Transfer and Overexposure policy issues)
62
What can you do with Privacy Risk Management alerts?
Create an issue out of
63
What are the benefits of turning a Privacy Risk Management alert into an issue?
1) Review data, 2) remediate the issue, 3) add people as collaborators
64
What are three ways to share a Privacy Risk Management issue with additional collaborators?
1) Secure Teams channel 2) Email 3) Link to the issue in Priva
65
What are the four types of DSR?
1) Access (summary of the data subject’s personal information held by your organization) 2) Export 3) Get items that were tagged as follow-up during review process 4) Delete
66
What is the workflow for DSR?
1) Create a search 2) Data estimate is generated in the "Data estimate" card in "Overview" 3) Data retrieval is performed 4) Review data from the "Data collected" tab 5) Generate a report 6) Download the reports from the "Reports" tab and share with data subject 7) Close
67
For which reasons would you pause the DSR process between the data estimate and retrieval? (2)
1) If you defined this as part of settings 2) If the estimate yields more than 300K items or 300 GB of data,
68
Where is the result of data retrieval as part of DSR being stored?
Azure Blob Storage container
69
What can you do as part of the review of retrieved data in a DSR?
1) Import additional files 1) Mark items as to Include or Exclude 3) Tag items as Follow-up, Delete or Update 4) Redact data not linked to the data subject on documents containing data of multiple data subjects (e.g., add black boxes)
70
What are the limitations when important additional files to a review set of a DSR?
Files must be less than 500MB each Only one import at the time per user
71
What is being created along with the data collection in a DSR?
A Teams channel, to facilitate the content review
72
What is the suffit being added to redacted documents as part of DSR?
_burn.pdf
73
How long does it take for DSR reports to be generated?
Up to 30min
74
What does the generated DSR reports contain (in addition to the actual data)? (3)
1) Extracted text fields 2) Export load files (original file names, because the files are renamed to help protect personal data) 3) Summary
75
What is the default retention period for DSR reports in Azure?
30 days from request closure
76
What is the main difference between PAM in Purview and in Azure?
In Purview it is a task level In Entra is it a role level
77
What is the default duration of granted access in PAM following just-in-time concept?
4 hours
78
What is the validity of an access request after submission?
24h
79
What is the PAM process?
1) Create approver group 2) Enabled PAM with the default approver group 3) Create an access policy 4) Submit access policy request 5) Approving the access policy request?
80
Where does the PAM process take place?
In O365 Admin Centre
81
What is the purpose of Customer Lockbox?
It ensures that Microsoft engineers cannot access organization data without explicit approval by Microsoft manager and the customer
82
What is the maximum duration of access granted to Microsoft engineers via Customer Lockbox?
4 hours
83
What is the default duration of a Customer Lockbox request?
12 hours
84
What is Adaptive Protection?
A preview feature that uses ML to identify and mitigate most critical risks. It allows the detection of "risky" users, than can the be used to fine-tune DLP and IRM policies.

SC-400 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions