Microsoft · SC-401
Insider risk alerts, cases, and Adaptive Protection
SC-401 · Lesson 11 of 13 · 1:07:04
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-401 exam (Microsoft Certified: Information Security Administrator Associate). In this lesson: triaging insider risk alerts (severity, 120-day review window, confirm or dismiss), managing cases (notice templates, escalation to eDiscovery Premium), forensic evidence, and Adaptive Protection's insider risk levels for DLP, Conditional Access, and data lifecycle management. Includes three original practice questions.
Preview the topics
- An employee shared a confidential file outside by accident, for the first time. The investigator wants a light, documented response. What fits?
- An investigator wants to see what a user actually did on screen, right before copying a design file to USB. What enables this?
- Users at an elevated insider risk level should be blocked from sharing sensitive files outside, automatically. What connects the risk level to the block?