Task 4.4: Describe insider risk, eDiscovery, and audit capabilities in Microsoft Purview

• APolicies

  Incorrect

  In the policies stage, admins define the risk indicators, users and conditions that are examined.

• BInvestigate

  Incorrect

  In investigation, cases bring together activities and evidence for reviewers to examine.

• CTriage

  Correct

  Triage is where reviewers evaluate alerts with a Needs review status and decide what to do with each.

• DAction

  Incorrect

  In the action stage, reviewers resolve cases, for example with a policy reminder or escalation.

The insider risk management workflow has five stages: policies define what's examined, alerts are generated when activities match, triage evaluates Needs review alerts (open a case, add to a case or dismiss), investigation brings activities, content and notes into a case, and action resolves cases with notifications or escalation to eDiscovery (Premium).

• APlace the content locations on hold

  Incorrect

  A hold preserves content where it is; it doesn't get items to people outside the organization.

• BAdd the law firm's lawyers to the case as members

  Incorrect

  Case members work inside the organization's eDiscovery tools, which the firm can't access.

• CExport the search results and download the package

  Correct

  Exporting copies the items from their original locations into a package that can be downloaded and given to reviewers outside the organization.

• DRun search and delete on the found items

  Incorrect

  Search and delete removes harmful content; it would destroy the evidence.

In an eDiscovery case, search results can be exported: the items are copied from their original content locations and packaged, and the package is downloaded to a local computer. That's how relevant data reaches people outside the investigation team or outside the Microsoft 365 organization for review.

• APriority user groups holding those people, in the policies

  Correct

  Users in high-risk positions can be placed in priority user groups for closer monitoring and more aggressive risk scoring.

• BAdaptive protection for the same users

  Incorrect

  Adaptive protection doesn't define which users get closer monitoring and more aggressive scoring.

• CA Communication Compliance policy for their messages

  Incorrect

  Communication Compliance is a separate solution with its own policies and reviewers; it doesn't change how insider risk scores these users.

• DPrivileged Identity Management for the administrators' roles

  Incorrect

  PIM makes admin roles just-in-time; it doesn't feed insider risk scoring.

Insider risk management helps detect and act on risky activities in the organization. For users in high-risk positions, such as executives or IT administrators, admins create priority user groups so that their activities get closer monitoring and more aggressive risk scoring.

• AIn the contractor's Microsoft Entra sign-in logs, which list the files each session opened

  Incorrect

  Sign-in logs record who signed in, to which application and how; they don't list the files Copilot accessed to answer a prompt.

• BIn the audit log, in the CopilotInteraction records of the contractor's prompts

  Correct

  Copilot interactions are logged automatically as part of Audit (Standard), and each record references the files and other resources Copilot accessed to answer.

• CNowhere yet, because Copilot activity is audited only for users with Audit (Premium)

  Incorrect

  Microsoft 365 Copilot interactions are logged in Audit (Standard); Premium adds features such as longer retention, which a three-week-old record doesn't need.

• DIn Compliance Manager's improvement actions for Microsoft 365 Copilot

  Incorrect

  Improvement actions are guidance for meeting a regulation's controls; they don't record which files Copilot accessed.

Microsoft Purview logs user interactions with Microsoft 365 Copilot automatically as part of Audit (Standard), across apps such as Teams, Word and SharePoint, so an organization that has auditing on needs no extra configuration. Each CopilotInteraction record shows who interacted with Copilot, when and where, and references the files, sites and other resources Copilot accessed to generate its response.

• AExchange Online, Teams, Microsoft 365 Groups, OneDrive, SharePoint and Viva Engage

  Correct

  These are the Microsoft 365 services eDiscovery supports.

• BOnly Exchange Online mailboxes

  Incorrect

  eDiscovery covers far more than mailboxes.

• COnly SharePoint sites and OneDrive accounts

  Incorrect

  Mail, Teams and other services are supported too.

• DOnly files on users' Windows devices

  Incorrect

  eDiscovery searches Microsoft 365 services, not local device storage.

Electronic discovery identifies and delivers electronic information that can be used as evidence in legal cases. Microsoft Purview eDiscovery identifies, reviews and manages content in Exchange Online, Microsoft Teams, Microsoft 365 Groups, OneDrive, SharePoint and Viva Engage.

• AOff until an admin buys Audit (Premium)

  Incorrect

  Audit (Standard) doesn't need Premium.

• BOff until an audit log retention policy is created

  Incorrect

  Retention policies are an Audit (Premium) feature, not a switch for auditing.

• CAvailable only after a Sentinel connector is set up

  Incorrect

  Audit doesn't depend on Sentinel.

• DAlready enabled

  Correct

  Audit (Standard) is turned on by default for organizations with the appropriate subscription.

Audit (Standard) is enabled by default for all organizations with the appropriate subscription. When an audited activity is performed, a record is generated and stored in the unified audit log, which users with the right permissions can search with the audit log search tool and export to CSV.

• AAn insider risk management policy template

  Incorrect

  Templates are the starting point for creating policies, and they don't show where risks lie before a policy exists.

• BAdaptive protection in insider risk management

  Incorrect

  Adaptive protection applies controls based on risk levels that policies produce.

• CAn eDiscovery (Premium) case

  Incorrect

  eDiscovery cases support legal investigations, not an assessment of insider risk areas.

• DInsider risk analytics

  Correct

  Analytics evaluates potential insider risks and helps decide the type and scope of policies, without prior policy setup.

Before configuring insider risk policies, organizations can run insider risk analytics to evaluate potential insider risks. It helps identify areas of higher user risk and decide the type and scope of policies to configure, without requiring any prior policy setup.

• A30 days

  Incorrect

  Audit (Standard) keeps records longer than that.

• B180 days

  Correct

  Audit (Standard) retains records for 180 days, enough to search roughly the past six months.

• CTen years

  Incorrect

  Audit (Standard) keeps records for far less time than that.

• DForever

  Incorrect

  Records aren't kept indefinitely in Audit (Standard).

Audit (Standard) retains audit records for 180 days, enough to search roughly the past six months. Longer retention, through audit log retention policies, is an Audit (Premium) capability.