SC 200 > General > Flashcards

General Flashcards

(48 cards)

Study These Flashcards
1
Q

Identity Protection Permission Groups

A

Security Admin
Security Operator
Security Reader

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security Admin

A

Can:
Full access to Identity Protection
Cant:
Reset password for a user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security Operator

A

Can:
View all Identity Protection reports and Overview screen, Dismiss user risk, confirm safe sign-in, confirm compromise
Cant:
Configure or change policies, Reset password for a user, Configure alerts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Security Reader

A

Can:
View all Identity Protection reports and Overview screen
Cant:
Configure or change policies, Reset password for a user, Configure alerts, Give feedback on detections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Enforcing information protection w Defender for Cloud Apps

A

Phase 1: Discover data, make sure apps arec onnected to defender so you can scan data with either an app connector or use Conditional access app
Phase 2: Classify data, default labels personal, public, general, confidential, highly confidential
Phase 3: Protect Data, create file policy to scan files in real time, or apply governance actions.
Phase 4: Monitor and report,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

UEBA

A

User and entity behavioral analytics (out of the box anomaly detection)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How many days does Microsoft Defender for cloud apps spend learning your enviorment?

A

Seven Days
It looks at the IP addresses, devices, and locations your users access, identifies which apps and services they use, and calculates the risk score of all of these activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Where do DLP alert show up?

A

Microsoft Defender XDR
Microsoft Purview (used for compliance focuses on the policy itself)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

DLP alert lifecycle

A

Trigger - action meets condition on DLP policy
Notify - if alert is generated, it goes to Defender portal & Purview alert dashboard, email can also be setup
Triage - reviewing new alerts, false positive?
Investigate - after assigning the owner, next step is to investigate further
Remediate - the alert owner decides what actions to take
Tune - tune DLP policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Types of DLP alerts within Purview

A

Single event - alert everytime a policy rule matches
Aggregate event - alert when threshold is met, ex: 10 matching events within 24 hours (can set by number of matches or volume of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Licensing requirments for DLP policy

A

Single event alert - E1, F1, G1, E3, or G3
Aggregate event alert - Requires an E5 license or one of the following add-ons for E3/G3:
Office 365 Advanced Threat Protection Plan 2
Microsoft 365 E5 Compliance
Microsoft 365 eDiscovery and Audit add-on

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Roles required to configure dlp alerts

A

Compliance Administrator
Information Protection Admin
Security Operator
Security Reader
Information Protection Investigator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How long do DLP alerts remain in the Purview alerts dashboard?

A

30 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

DLP Emails might be unavailable to download

A

An internal sender deleted the message sent to an external recipient
An external sender’s message was deleted by the internal recipient
Both internal sender and recipient deleted the message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

DLP Response actions in Purview

A

Set alert status to track progress, such as Investigating or Resolved
Assign the alert to a reviewer for accountability
Add comments to capture internal notes or observations
Share alert details using a generated read-only link
View user activity summary (if Insider Risk Management is integrated)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

DLP Response actions in Defender XDR

A

Update the incident status, assign it to a team member, and add notes
Apply classifications like True Positive or False Positive and specify a reason
Take remediation actions directly, such as:
Disabling a user account
Removing file access
Applying a sensitivity or retention label

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Alert Generation process

A

Settings configured - configure policy settings to align with their insider risk management strategy.
policy Created - Policies define whose activity to evaluate, what activity to detect, and which events should trigger active monitoring.
Triggered event occurs - triggering event activates the policy for a specific user
user activity evaluated and scored - The system begins monitoring the user’s actions. Activities are assigned risk scores based on the type of activity, configured thresholds, and the user’s history.
Alert generation - An alert is generated if the user’s risk score exceeds the policy-defined threshold.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Microsoft Purview Insider Risk Managment

A

helps investigators and analysts view, prioritize, and take action on potentially risky user activity. Each alert is based on policy-defined conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Microsoft Purview Insider Risk Managment Alert Details Retention

A

Alerts in “Needs Review” are retained for 120 days, after that they will be deleted unless linked to an active case.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

All risk factors tab in Microsoft Purview Insider Risk Management

Study These Flashcards
A

provides a summary of potentially risky activity associated with an alert.

21
Q

All risk factors shown in Purview Insider Risk Managment

Study These Flashcards
A

Top exfiltration activities: Lists the most frequent exfiltration actions, such as archiving or uploading files.
Cumulative exfiltration: Shows whether repeated actions build over time to indicate rising risk.
Sequences of activities: Highlights related activities that form a recognizable risk sequence.
Priority content: Indicates whether the user interacted with files marked as sensitive or business-critical.
Unallowed domains: Flags any file or data transfers to domains that aren’t permitted by policy.
Unusual behavior or high-impact user status: Detects abnormal patterns or identifies users whose role or access level contributes to elevated risk.

22
Q

Content Detected within Purview

Study These Flashcards
A

shows specific items involved in each risk activity.

23
Q

Activity Explorer tab in Purview Insider Risk Managment

Study These Flashcards
A

investigate the full context of potentially risky behavior. This tab shows a timeline of user activity that contributes to the alert, with detailed metadata to support investigation, filtering, and review.
Use this tab to confirm what triggered the alert and identify patterns or supporting evidence that indicate whether further action is needed.

24
Q

Activity Explorer tab in Purview Insider Risk Managment Filters

Study These Flashcards
A

Activity scope: Show all scored activity for the user or only activity associated with this specific alert
Risk factor: Focus on specific indicators like sequences, cumulative exfiltration, unallowed domains, or priority content
Review status: Hide previously reviewed items to focus on new activity

25
User Activity tab in Purview Insider Risk Managment
shows a visual timeline of potentially risky behavior over time. This view helps investigators assess whether a user’s activity is ongoing, escalating, or part of a broader pattern. Use this tab to evaluate risk across multiple alerts and understand how individual actions fit into a larger risk profile.
26
Does alert status and classification sync between Purview and Defender?
Yes Defender status (New, In progress) vs Insider Risk Management status (Needs review) Defender status(Resolved) vs Insider status (Dismissed or Confirmred (based on classification)) Defender classification (True positive) vs insider classification (Confirmed) Defender class (Information expected activity, False positive) Insider classification (Dismissed)
27
KQL
Kusto Query Language
28
Before alerts appear in Microsoft Defender what setting needs to be enabled?
The setting Share user risk details with other security solutions must be enabled in the Microsoft Purview portal
29
Cases in Microsoft Purview Insider Risk Management
Use the Cases dashboard to view all active and closed cases, assign ownership, and manage follow-up actions such as escalation, communication, and resolution.
30
True or false all alerts require a case?
False, you dont have to create a case from an alert, you can dismiss or confirm from the alerts dahsboard
31
Actions on a case
Send email notice Escalate for investigation Run Power Automate flows Create or view Teams team Resolve a case - Benign (low risk or false positive) Conirmed policy violation
32
Microsoft Purview > insider Risk Managment > Alerts > All risk factors, Activity Explorer, User activity
33
Microsoft Purview Audit
provides tools to log user and administrator activities, helping organizations protect their data and meet compliance standards. Consider a network of healthcare facilities that manages a large amount of sensitive patient data daily. After noticing unusual access patterns to their electronic health records (EHR), they need to confirm all access is authorized and aligns with health data protection regulations. The compliance team turns to Microsoft Purview Audit to strengthen oversight, investigate activity, and support regulatory requirements.
34
Microsoft Purview Audit Solutions
Standard and Premium Standard - default, API access, 180 day retention Premium - Audit log retention configure for up to a year or 10 years with add on license retention is default to 1 year, intelligent insights, higher API bandwidth, can also record more granual activities in Exchange Online and teams
35
Suubscription needed for Audit standard and premium
Audit (Standard) is included in: Microsoft 365: E3, E5, F1, F3 Office 365: E1, E3, E5, F3 Audit (Premium) requires: Microsoft 365: E5, E5 Compliance, F5 Compliance, F5 Security + Compliance Office 365: E5
36
Audit permissions needed
Assign the Audit Logs or View-Only Audit Logs roles in the Microsoft Purview portal. These roles are included in the Audit Reader and Audit Manager role groups. Audit Manager: This role lets you search and export audit logs, and manage audit settings, including enabling or disabling logging. Audit Reader: This role lets you search and export audit logs but doesn't allow changes to audit settings.
37
What is the maximum number of search jobs a user can run at the same time in the Microsoft Purview compliance portal?
up to 10
38
Audit Premium how to access compromised accounts
MailItemsAccessed provides detailed records of how and when emails are accessed, making it a critical event type for investigations involving sensitive communications.
39
Audit sync vs bind access
Sync access: Logs a single event when multiple emails are downloaded during a session, like when using Outlook. Bind access: Logs each time an individual email is opened or interacted with.
40
Manage audit log volume, when is it throttled?
Exchange Online throttles MailItemsAccessed logging if a mailbox logs more than 1,000 bind events in 24 hours. Throttling: Affects less than 1% of mailboxes Only pauses logging for MailItemsAccessed events, not other activities Applies to bind operations only; sync activities are unaffected Might result in gaps where bind events weren't recorded
41
Duplicate audit records with premium
Sync operations are filtered at one-hour intervals unless distinct changes in key properties are detected. Bind operations generate a new audit record only if certain properties differ from previously logged operations within the same hour. These properties include: ClientIPAddress: The IP address from where the mailbox was accessed. ClientInfoString: Details about the client and protocol used. ParentFolder: Location within the mailbox. Logon_type: Distinguishes between owner, admin, or delegate access. MailAccessType: Specifies if the operation was a bind or sync. MailboxUPN and User: Identity of the mailbox and the user accessing it. SessionId: Helps in distinguishing between different sessions of access, providing a clear timeline of actions.
42
Exporting Audit log data
Both standard and premium allows downloading a CSV file You can export 50,000 entries from a single search
43
What is eDiscovery?
feature in the Microsoft Purview portal that enables authorized users to create cases, search for content, place holds to preserve data, and export results. It's designed to support internal investigations, legal obligations, regulatory audits, and incident response.
44
Licensing for eDiscovery
Core eDiscovery features are included in Microsoft 365 E3 and E5 plans. Advanced features might require separate licensing.
45
Role needed for eDiscovery
eDiscovery Manager: Allows users to create and manage eDiscovery cases, run content searches, and export results. eDiscovery Administrator: Includes all eDiscovery Manager permissions, plus the ability to manage role assignments and settings across all cases.
46
Does eDiscovery search require a case?
Every search must be associated with a case. The case model provides: Controlled access to investigation data An auditable trail of search and export actions A consistent structure for managing investigation tasks
47
eDiscovery Phases
Phase 1: Define Search criteria - (search name, data source, a KQL query) Phase 2: Identify data sources - Phase 3: build the query - Phase 4: Run and review the results - Statistics: View summary data about the search, including the number of items found, size of the results, and breakdown by location. Sample: View a random sample of the search results to validate your query before proceeding.
48
eDiscovery exporting
You can export: Only indexed items that matched your search query Indexed items and partially indexed items Only partially indexed items Additional ways: Mailboxes and Teams Thread conversations into HTML transcripts (especially useful for chat review) Include contextual Teams and Viva Engage messages (up to 12 hours of related conversation) Include cloud attachments from SharePoint or OneDrive, and choose the version range to include Export mailbox content: PST or MSG file Access export in Process manager
SC 200
flashcards
Decks in class (12)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions