SC-401 Practice Question 3613
Exam: SC-401
Domain: Manage risks, alerts, and activities
Difficulty: hard
You want to capture visual desktop screenshots and recording clips when a high-risk employee copies proprietary blueprints to personal cloud storage. Which feature should you enable in Insider Risk Management?
Answer Options
A
Forensic Evidence
B
Activity Explorer
C
Audit (Standard)
D
Content Explorer
Correct Answer
A: Forensic Evidence
Explanation
Forensic Evidence in Insider Risk Management captures security-focused desktop visual recordings of user activity when high-priority risk indicators are triggered.