Detecting Data Exfiltration by Departing Employees in Microsoft 365
Short answer
C Use Microsoft Purview Insider Risk Management to monitor and detect data exfiltration behaviors associated with a departing employee.
Question
User1 plans to leave your company in two weeks.
You need to capture the activity of User1 to identify whether the user is exfiltrating data.
Which Microsoft Purview solution should you use?
Key Takeaways
The question tests knowledge of specific Purview modules, trapping users who might confuse behavioral monitoring (Insider Risk) with content compliance (Communication Compliance) or data retention (Lifecycle Management).
Learn how to use Microsoft Purview Insider Risk Management to detect data exfiltration risks from departing employees in Microsoft 365 subscriptions.
Common mistake: Users often select Communication Compliance (A), assuming all 'compliance' tools handle risk. However, Communication Compliance analyzes text content for policy violations, whereas Insider Risk Management analyzes user actions and file movements for exfiltration.
Expert Analysis
The scenario presents a clear objective: detect potential data exfiltration by a user who is leaving the organization. In the Microsoft 365 security architecture, this specific use case falls under Insider Risk Management.
Insider Risk Management is designed to monitor and analyze user activity across Microsoft 365 services to identify risky behavior. It includes pre-built policies for specific scenarios, most notably "Departing Employee." This policy monitors indicators such as unusual file downloads, access to sensitive documents, or attempts to move data to personal storage before an employee leaves. The comments provided correctly highlight that Insider Risk Management is the dedicated solution for detecting these types of insider threats and exfiltration patterns.
Let's evaluate why the other options are incorrect:
- Communication Compliance (A) focuses on monitoring communications (emails, chats, posts) for regulatory violations or harmful content, not specifically for tracking file movements or exfiltration by departing staff.
- Data Security Posture Management (B) is a dashboard tool that helps organizations assess their security posture and remediate configuration issues; it does not actively monitor individual user behavior for exfiltration.
- Data Lifecycle Management (D) handles the retention, disposition, and deletion of data over time based on governance rules. While it manages data states, it does not provide the behavioral analytics needed to catch active theft or exfiltration attempts.
Therefore, because the goal is to capture activity related to a departing employee potentially stealing data, Insider Risk Management is the only appropriate Purview component.
Exam Strategy
When answering questions about Microsoft Purview, map the specific threat type to the correct module. Use keywords like 'departing employee,' 'insider threat,' or 'exfiltration' to immediately point to Insider Risk Management. Avoid selecting Communication Compliance unless the question explicitly mentions analyzing email/chat content for regulated phrases or harmful language. Similarly, avoid Data Lifecycle Management if the focus is on active detection rather than long-term retention or deletion.
Frequently Asked Questions
What is the primary difference between Insider Risk Management and Communication Compliance?
Can Insider Risk Management detect data exfiltration via USB drives?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
omath 👍 6 Answered CAnswer: C. Insider Risk Management. Explanation: Microsoft Purview Insider Risk Management is specifically designed to detect and investigate behaviors such as: - Data exfiltration - Unusual file downloads or sharing - Use of personal email, USB, cloud storage - Sudden spikes in data access - Risky actions by users who are leaving the organization It even includes a built‑in “Departing Employee” policy template, which is exactly the scenario you described.
-
fa62dd5 👍 4 Answered C✅ Correct answer: C. Insider Risk Management Why (exam‑focused): You need to capture and analyze user activity to detect potential data exfiltration, especially for a departing employee. Microsoft Purview Insider Risk Management is specifically designed to: Monitor risky user behavior Detect data exfiltration patterns (downloads, uploads, sharing, emails) Handle scenarios like employees leaving the organization
-
Austerer 👍 1 Answered C• Insider Risk Management is built to detect, investigate, and help mitigate risky insider activities, such as data theft and exfiltration by departing employees.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.