Design security operations, identity, and compliance capabilities →easyMultiple ChoiceObjective-mapped
Detect Insider Data Exfiltration with Microsoft Purview Insider Risk Management
Your organization has a Microsoft 365 E5 subscription and wants to detect insider data exfiltration attempts. You need to design a solution that can identify users copying sensitive data to personal cloud storage services. Which Microsoft Purview capability should you use?
Quick Answer
The correct answer is Microsoft Purview Insider Risk Management because it is specifically designed to detect insider data exfiltration attempts by analyzing user activities, such as copying sensitive data to personal cloud storage services, through behavioral indicators and risk scoring. Unlike Data Loss Prevention, which enforces policies to block data sharing at the endpoint, Insider Risk Management focuses on identifying suspicious patterns—like unusual file uploads to personal cloud apps—that signal exfiltration intent. On the Microsoft Cybersecurity Architect exam, this question tests your ability to distinguish between prevention and detection capabilities within Purview, with a common trap being to select DLP because it deals with data protection. A useful memory tip is to think of Insider Risk Management as the “detective” that spots the leak, while DLP is the “guard” that tries to stop it at the door.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insider Risk Management
Insider Risk Management in Microsoft Purview is specifically designed to detect insider data exfiltration scenarios, including copying data to personal cloud storage. Option A is wrong because Data Loss Prevention (DLP) policies are preventive controls that block or warn about sharing sensitive data but do not detect exfiltration attempts based on user activities. Option B is wrong because eDiscovery (Premium) is used for legal discovery and investigations, not for real-time detection of insider risks. Option C is wrong because Communication Compliance focuses on identifying inappropriate communications (e.g., harassment, sharing sensitive info via email or Teams), not on monitoring data exfiltration to personal cloud services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Loss Prevention (DLP) policies
Why it's wrong here
Incorrect. DLP policies prevent data from being shared but do not detect exfiltration attempts based on user behavior patterns.
- ✗
eDiscovery (Premium)
Why it's wrong here
Incorrect. eDiscovery (Premium) is for legal discovery and investigation, not for detecting real-time exfiltration attempts.
- ✗
Communication Compliance
Why it's wrong here
Incorrect. Communication Compliance focuses on inappropriate communications, not data exfiltration activities.
- ✓
Insider Risk Management
Why this is correct
Correct. Insider Risk Management uses behavioral analytics to detect risky activities like copying data to personal cloud storage.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Purview to govern sensitive data. You need to design a solution that automatically detects and protects credit card numbers in emails and documents stored in Microsoft 365. The solution should also provide data loss prevention (DLP) policy tips to users when they try to share such data externally. What should you configure?
medium- A.Sensitivity labels with auto-classification
- ✓ B.Microsoft Purview Data Loss Prevention policies
- C.Microsoft 365 compliance center
- D.Microsoft Information Protection unified labeling
Why B: You need a solution that automatically detects credit card numbers in emails and documents and provides DLP policy tips when sharing externally. Microsoft Purview Data Loss Prevention (DLP) policies (Option B) are designed for this purpose: they can detect sensitive info types like credit card numbers and show policy tips to users. Option A (Sensitivity labels with auto-classification) is incorrect because sensitivity labels are for classification and protection, not for real-time DLP policy tips with end-user notifications. Option C (Microsoft 365 compliance center) is incorrect because it is the portal used to manage compliance features, not a specific configuration for DLP tips. Option D (Microsoft Information Protection unified labeling) is incorrect because unified labeling focuses on label management and does not directly provide DLP policy tips.
Variation 2. Your organization uses Microsoft Purview to protect sensitive data. You need to create a sensitivity label that automatically encrypts documents containing credit card numbers when they are shared externally. Which configuration should you use?
medium- A.Create a trainable classifier to detect credit cards
- ✓ B.Create an auto-labeling policy that applies a label with encryption for external sharing
- C.Create a default label policy for SharePoint
- D.Create a manual sensitivity label that users apply
Why B: Auto-labeling in Purview can be configured to apply a sensitivity label based on sensitive info types like credit card numbers. The label should have encryption enabled for external sharing. The other options describe different scenarios: manual labeling, default labeling, or classification without encryption.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.