Question 870
At the Cedarport professional services partnership, an analyst needs to understand when sensitivity labels were changed or DLP actions occurred rather than viewing a static classification count. Which underlying issue most directly explains this situation?
Explanation
Correct Answer
The evidence indicates that Activity explorer emphasizes events and user actions involving protected information. The appropriate response is to use Microsoft Purview Activity explorer to examine supported labeling and policy events and demonstrate that a controlled label modification appears with the expected actor and timestamp in the activity view. This result addresses the stated challenge at the Cedarport professional services partnership.
Incorrect Answers
A storage permission alone may not enforce a content-aware external sharing restriction. That is not the mechanism that accounts for the stated failure at the Cedarport professional services partnership.
The case does not describe the failure mode involving ediscovery content search. Its core issue is that Activity explorer emphasizes events and user actions involving protected information. For the Cedarport professional services partnership, the direct corrective action is to use Microsoft Purview Activity explorer to examine supported labeling and policy events.
Although user-related data risk policy scenarios differ from malware detection alerts and should match the investigation purpose, the presented symptoms do not support that as the primary cause; they indicate that Activity explorer emphasizes events and user actions involving protected information. For the Cedarport professional services partnership, the direct corrective action is to use Microsoft Purview Activity explorer to examine supported labeling and policy events.