Practice question 35 of 498 · medium
Which two practices address insider-risk investigation without assuming every alert proves malicious intent? Select two answers.
Select all that apply. Every correct option and no extras are required for credit in the app.
Show the answer and explanation
✓ Correct answers
- Correlate activity and context before deciding an appropriate response
- Use privacy-preserving access controls and audited investigator permissions
Use privacy-preserving access controls and audited investigator permissions: This supports authorized investigation while reducing unnecessary exposure of personal data. Correlate activity and context before deciding an appropriate response: Risk indicators can arise from inadvertent or legitimate behavior as well as malicious actions. Publish all flagged employees to every administrator: Broad disclosure conflicts with privacy-oriented investigation controls. Treat a single risk alert as conclusive proof of deliberate theft: An alert is a signal for assessment, not a final judgment. Disable all logging of investigator activity: Auditing helps govern access and accountability.
Read and review here, or open the app to practise and save your results on this device.
Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.