Microsoft Certified: Security Operations Analyst Associate Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  Microsoft Purview Insider Risk Management has a policy template called Data theft by departing users. It is built for this situation: when a user's account is deleted or they leave, the policy looks back at their activity (such as downloading numerous SharePoint documents) over the period before they left and generates an alert. The lookback is what the question's "during the month before their accounts were deleted" is testing.

• Chose D1

  This is a classic use case for an insider risk policy, particularly the "Departing employee" template, which monitors for unusual activity in the days or weeks leading up to a user leaving the organization.

• Chose D1

  Correct answer is D