AB-900 Certification Practice Question #31

Question

Your organization has a Microsoft 365 subscription that contains a user named User1.
User1 plans to leave your company in two weeks.
You need to capture the activity of User1 to identify whether the user is exfiltrating data.
Which Microsoft Purview solution should you use?

Accepted Answer

Capturing a **departing user's** activity to detect **data exfiltration** is exactly what **Microsoft Purview Insider Risk Management** does — its built-in **"Data theft by departing users"** policy template uses exfiltration indicators (SharePoint/OneDrive downloads, copying to USB or personal cloud) and correlates them with the user's resignation/termination dates. Communication Compliance inspects message content, Data Lifecycle Management handles retention, and DSPM addresses data posture — none targets departing-employee exfiltration.

More AB-900 practice questions