SC-400 Online Practice Questions and Answers

Correct Answer: B

Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/record-versioning?view=o365-worldwide

Correct Answer: A

Use the Get-UnifiedGroup cmdlet to view Microsoft 365 Groups in your cloud-based organization. To view members, owners and subscribers for Microsoft 365 Groups, use the Get-UnifiedGroupLinks cmdlet.

Syntax:

Get-UnifiedGroup [[-Identity] ] [-Filter ] [-IncludeAllProperties] [-IncludeSoftDeletedGroups] [-ResultSize ] [-SortBy ] []

Note:

Examples

Example 1

Get-UnifiedGroup

This example returns a summary list of all Microsoft 365 Groups.

Example 2

Get-UnifiedGroup | Format-List DisplayName,EmailAddresses,Notes,ManagedBy,AccessType

This example returns the following information about all Microsoft 365 Groups:

Display name

Email address

Description

Owners

Privacy

Example 3

-Identity "Marketing Department" | Format-List

This example returns detailed information about the Microsoft 365 Group named Marketing Department.

Example 4

Get-UnifiedGroup | Where-Object {-Not $_.ManagedBy}

This example returns Microsoft 365 Groups that do not have an owner.

Incorrect:

* Get-Team

This cmdlet supports retrieving teams with particular properties/information, including all teams that a specific user belongs to, all teams that have been archived, all teams with a specific display name, or all teams in the organization.

Syntax

Get-Team -GroupId [-User ] [-Archived ] [-Visibility ] [-DisplayName ] [-MailNickName ] [-NumberOfThreads ] []

Parameter -MailNickName

Specify the mailnickname of the team that is being returned. This acts as a filter instead of being an exact match.

Example

Get-Team -MailNickName "BusinessDevelopment"

Returns the team with the specified MailNickName. (This acts as a filter rather than an exact match.)

* Get-TeamChannel

This cmdlet supports retrieving channels hosted by a team.

Syntax

Get-TeamChannel -GroupId [-MembershipType ] []

* Get-MailUser

Use the Get-MailUser cmdlet to view mail users and also guest users for Microsoft 365 Groups in cloud environments.

Reference: https://learn.microsoft.com/en-us/powershell/module/exchange/get-unifiedgroup

Correct Answer: C

Correct Answer:

Correct Answer:

Correct Answer:

Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/declare-records?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/compliance/get-started-with-sensitivity-labels?view=o365-worldwide

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

Box 1: Data theft by departing users

Policy1: Monitors the printing of files by users that submitted their resignation.

Data theft by departing users

When users leave your organization, there are specific risk indicators typically associated with potential data theft by departing users. This policy template uses exfiltration indicators for risk scoring and focuses on detection and alerts in this

risk area. Data theft for departing users might include downloading files from SharePoint Online, *printing files*, and copying data to personal cloud messaging and storage services near their employment resignation and end dates.

Note: Insider risk management analysts and investigators may use cumulative exfiltration detection insights to help identify exfiltration activities that may not typically generate alerts but are above what is typical for their organization. Some

examples may be departing users slowly exfiltrate data across a range of days, or when users repeatedly share data across multiple channels more than usual for data sharing for your organization, or compared to their peer groups.

Incorrect:

* Security policy violations by departing users

Box 2: Data leaks by priority users

Policy2: Monitors the accidental sharing of data outside of an organization by users in a priority user group.

Data leaks by priority users (preview)

Protecting data and preventing data leaks for users in your organization might depend on their position, level of access to sensitive information, or risk history. Data leaks can include accidental *oversharing* of highly sensitive information

outside your organization or data theft with malicious intent. With an assigned data loss prevention (DLP) policy as a triggering event option, this template starts scoring real-time detections of suspicious activity and result in an increased

likelihood of insider risk alerts and alerts with higher severity levels. Priority users are defined in priority user groups configured in the insider risk management settings area.

Box 3: Data Leaks

Policy3: Monitors the downloading of files from Microsoft SharePoint Online to personal cloud storage services

Data leaks

Protecting data and preventing data leaks is a constant challenge for most organizations, particularly with the rapid growth of new data created by users, devices, and services. Users are empowered to create, store, and share information

across services and devices that make managing data leaks increasingly more complex and difficult. Data leaks can include accidental oversharing of information outside your organization or data theft with malicious intent. With an assigned

Microsoft Purview Data Loss Prevention (DLP) policy, built-in, or customizable triggering events, this template starts scoring real-time detections of suspicious *SharePoint Online data downloads*, file and folder sharing, printing files, and

copying data to personal cloud messaging and storage services.

Reference:

https://learn.microsoft.com/en-us/purview/insider-risk-management-policy-templates

https://learn.microsoft.com/en-us/purview/insider-risk-management-policies