Detect Data Theft by Departing Users with Insider Risk Management

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender XDR

Short answer

D Use an insider risk policy to detect data exfiltration by departing users who downloaded numerous documents from SharePoint Online.

Question

You have a Microsoft 365 E5 subscription that uses Microsoft SharePoint Online.
You delete users from the subscription.
You need to be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted.
What should you use?
  1. a file policy in Microsoft Defender for Cloud Apps
  2. an access review policy
  3. an alert policy in Microsoft Defender for Office 365
  4. an insider risk policy Correct Answer

Key Takeaways

The main trap is confusing general cloud app security monitoring (Defender for Cloud Apps) with the specialized insider risk management features designed specifically for departing employee scenarios.

This question tests knowledge of Insider Risk Management in Microsoft Purview. The correct answer is an insider risk policy, which is designed to detect data theft by departing users, including unusual download activities from SharePoint Online before accounts are deleted.

Common mistake: Many candidates choose Option A (File Policy in Defender for Cloud Apps) because it monitors file downloads. However, Insider Risk Management (Option D) is the dedicated solution for 'departing user' scenarios and provides deeper behavioral analytics and historical risk scoring for data exfiltration.

Expert Analysis

The scenario involves monitoring user activity to detect potential data exfiltration by employees who are leaving the organization. Microsoft provides a specific solution for this via Insider Risk Management in the Microsoft Purview compliance portal.

The key here is the phrase "deleted users" (departing employees) and "downloaded numerous documents" (data exfiltration). Microsoft Defender for Cloud Apps (Option A) offers file policies that can monitor download activities, but these are typically focused on active sessions and real-time control or alerting for current users. While it has some departure capabilities, the primary and most robust tool designed specifically for managing risks associated with departing insiders—including detecting suspicious downloads before account deletion—is the Insider Risk Policy (Option D).

According to Microsoft documentation, Insider Risk Management includes templates such as 'Data theft by departing users.' This template uses risk indicators like downloading large numbers of files from SharePoint Online or OneDrive to score and alert on potential data breaches by employees who are leaving the company. The policy runs against historical data and can identify patterns leading up to the termination/deletion of the account. Options B (Access Review) and C (Alert Policy in Defender for Office 365) do not address the specific context of departing employee data theft behavior effectively.

Official Reference

https://learn.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management-policies?view=o365-worldwide#data-theft-by-departing-users

This link opens the official vendor documentation in a new tab.

Exam Strategy

When you see keywords like 'departing,' 'leaving,' 'terminated,' or 'deleted users' combined with 'data theft' or 'exfiltration,' think immediately of Insider Risk Management. It is the specific module within Microsoft Purview Compliance Center designed for these lifecycle events. General monitoring tools like Defender for Cloud Apps are for active users and real-time controls, whereas Insider Risk handles the retrospective and predictive analysis of at-risk insiders.

Frequently Asked Questions

Can Defender for Cloud Apps monitor departing users?

Defender for Cloud Apps primarily focuses on active user sessions and real-time anomaly detection. For comprehensive analysis of departing user behavior and historical data exfiltration patterns, Insider Risk Management is the recommended tool.

What is the difference between Insider Risk Policy and File Policy?

A File Policy in Defender for Cloud Apps monitors file access and sharing in real-time for active users. An Insider Risk Policy analyzes user behavior over time to assign risk scores, specifically targeting high-risk behaviors like data theft by employees who are leaving the organization.

More SC-200 FAQ →

Community Votes

D
71%
A
17%
C
12%

71% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 60 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 60

  1. Metasploit 👍 30 Answered D
    D: Insider risk policy. Data theft by departing users: https://learn.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management-policies?view=o365-worldwide#data-theft-by-departing-users When users leave your organization, there are specific risk indicators typically associated with data theft by departing users. This policy template uses exfiltration indicators for risk scoring and focuses on detection and alerts in this risk area.
  2. espnadmin 👍 20
    D. an insider risk policy
  3. vannear 👍 5 Answered D
    My first day on my first job was to review the trainning session from Micrsoft, they highlighted this "Insider Risk"feature several times, the correct answer defenitely is D.
  4. Bendik 👍 5 Answered C
    It is not specified that the user is leaving so an insider risk policy would be wrong. C is still correct
  5. RafaAbel 👍 4
    I agree due to the context, this guy was leaving the company then being monitored by insider risk policy
Show 25 more comments
  1. Lokmane14 👍 4 Answered D
    D seems to be correct, insider risk policy suits to this question.
  2. Bhuru 👍 4
    D is also the answer on Microsoft practise test as well.
  3. uday1985 👍 3
    requires an alert.. stop assuming : An insider risk policy is used to monitor and detect risky behavior by employees within an organization. This policy can help identify and prevent insider threats such as data theft, sabotage, and espionage.
  4. Vimukthiw 👍 3 Answered D
    Refer to the Data Theft by Departing Users Section - https://docs.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management-policies?view=o365-worldwide
  5. gepoy01 👍 3
    an alert policy in Microsoft Defender for Office 365
  6. Myozymm 👍 3
    correct answers is C
  7. Oryx360 👍 2 Answered A
    A. A file policy in Microsoft Defender for Cloud Apps For the scenario described, where you want to be notified if deleted users downloaded numerous documents from SharePoint Online sites before their accounts were deleted, the correct choice is to use a file policy in Microsoft Defender for Cloud Apps (formerly known as Microsoft Cloud App Security). A file policy allows you to monitor file activities, such as downloads, in cloud applications like SharePoint Online. You can set conditions based on user actions, timeframes, and other factors to trigger alerts when specific actions match the defined criteria. This enables you to receive notifications about abnormal or potentially unauthorized activities involving document downloads by the deleted users. The other options (B, C, and D) are not directly suited to this specific scenario, as they focus on different aspects of security and management within the Microsoft 365 environment.
  8. emartiy 👍 2 Answered C
    To be notified if deleted users downloaded numerous documents from SharePoint Online sites before their accounts were deleted, consider the following approach: Configure an Alert Policy in Microsoft Defender for Office 365 (Option C): Set up an alert policy that monitors user activity related to document downloads in SharePoint Online. Customize the policy to trigger alerts when specific thresholds (e.g., numerous downloads) are exceeded. Ensure that the policy covers the relevant time frame (e.g., the month before account deletion). Remember that alert policies allow you to proactively monitor and respond to security-related events, including user activity in SharePoint Online. 😊 1
  9. khrid4 👍 2
    Data theft by departing users Collection: Detects download activities by in-scope policy users. Example risk management activities include downloading files from SharePoint sites or moving files into a compressed folder. https://learn.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management-policies?view=o365-worldwide#data-theft-by-departing-users
  10. yongda 👍 2
    D & C are both reasonable answers. However, the question did not state that the deleted user is leaving the organization. Therefore, for this question C might be the 'better' answer
  11. Jacob_Plummer 👍 2
    This exact question nearly word for word is on the microsoft practice exam for the SC-200 and the answer they give is "a Microsoft Purview insider risk management policy"
  12. AK4U_111 👍 2
    C M365 Defender Portal > Policies & Rules > New Alert Policy > Category: Information Governance > Activity is: Downloaded File > go from there
  13. Avaris 👍 2 Answered A
    File policy focus on SP while alert policy focus on emails so its A and defo not user risk as this is related to the use's risk posture.
  14. mimguy 👍 2
    It says 'You need to be notified'. The insider risk policy will detect and the alert policy will notify. It's got to be C.
  15. uday1985 👍 2
    it can be done using both. I tried and the option is available. stupid question
  16. natxu 👍 2 Answered D
    You need an Insider Risk Management policy based in Employee Departures.
  17. AbdulMueez 👍 2
    An alert policy from the endpoint is the right Answer. So C is correct.
  18. Fukacz 👍 2 Answered D
    Insider risk is literally made for this
  19. imhere4you 👍 2
    On exam - 19 June 2023
  20. Jadeitalia365 👍 2 Answered D
    Insider risk
  21. Nikki0222 👍 2
    D correct
  22. Durden871 👍 1
    Then again. The answer given is create a policy in Compliance Center, not Defender. If you ask it directly: User "Can insider risk management be used to alert if deleted users had downloaded thousands of sharepoint files" While IRM provides robust capabilities for identifying suspicious activities and behaviors, such as data exfiltration attempts or unusual access patterns, it may not directly offer a specific alert condition for detecting if deleted users had downloaded thousands of SharePoint files. While IRM may not offer a predefined alert condition specifically for tracking file downloads by deleted users, you can leverage its flexibility to create custom alert policies that meet your organization's specific monitoring and security requirements. So it really sounds like there's no correct answer listed. It's an alert policy created in the compliance center, not Defender. To be fair, the answer given also stated, "as of 2022".
  23. Zak_Zakaria 👍 1
    Also, I thought the answer would be an insider risk policy, but I'm now more convinced that it's A as explained by Copilot, I think he's right, and here is why: -Insider Risk policy is for active users not deleted ones as mentioned in the question, and no way to set deleted users as insider risk. -For option C: idem, we can't set alerts for deleted users who are not anymore in the company, and even if we can (technically), it won't serve anything as long as the user is not active anymore to trigger the alert. -But option A: is more likely correct since we can trigger the deletion of files and fine-tune to filter for users recently deleted and their activity in the last month. I think it makes more sense, and maybe Copilot is right :).
  24. HAjouz 👍 1 Answered A
    A. a file policy in Microsoft Defender for Cloud Apps This option allows you to create policies that can monitor and alert you on specific activities, such as downloading a large number of documents, which is crucial for identifying potential data exfiltration before user accounts are deleted.a file policy in Microsoft Defender for Cloud Apps is specifically designed to monitor and control file activities, including downloads, across your cloud environment. insider risk can be used to monitor and alert on risky activities, it is more comprehensive and typically used for ongoing monitoring of insider threats rather than specific scenarios like monitoring document downloads before account deletion.
  25. mali1969 👍 1 Answered C
    Alert policies let you categorize the alerts that are triggered by a policy, apply the policy to all users in your organization, set a threshold level for when an alert is triggered, and decide whether to receive email notifications when alerts are triggered. Default alert policies include: Unusual external user file activity - Generates an alert when an unusually large number of activities are performed on files in SharePoint or OneDrive by users outside of your organization. This includes activities such as accessing files, downloading files, and deleting files. This policy has a High severity setting. Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Least-privilege roles for Microsoft 365 Defender action approvals

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide