A public works department explains what Insider Risk Management is designed to surface. Which description is accurate?

An accurate description of Insider Risk Management for public works is that it surfaces signals and alerts about potentially risky user activities that may indicate insider threats to municipal data. The capability is people-and-activity oriented: unusual exfiltration, risky sharing, or other policy-relevant behaviors that threaten municipal information—not alerts that trigger policy-based blocking of external sharing, not signals of code-of-conduct violations in collaboration, and not alerts requiring retention and legal search of mailboxes.

Alerts about potentially risky insider activities that may trigger policy-based blocking of external municipal sharing fails the concept: surfacing risk signals for investigation is detection, not preventive enforcement that blocks sharing. Signals about potentially risky insider messages that may indicate code-of-conduct violations in municipal collaboration fails the scope: reviewing messages for conduct violations is Communication Compliance, not Insider Risk Management which focuses on data-risk indicators like exfiltration. Alerts about potentially risky insider activities that may require retention and legal search of municipal mailboxes fails the purpose: retention and legal search for public records are eDiscovery and records-management functions, not insider threat detection.

Exam caveat: AB-900 identify-level items often mix absurd distractors with the correct Purview purpose statement. Anchor on “risky user activities / insider threats to data” when you see Insider Risk Management. Do not confuse it with alerts that trigger policy-based blocking of external sharing, signals of code-of-conduct violations in collaboration, or alerts requiring retention and legal search of mailboxes—those are distinct capabilities.

Operational check: Confirm public works security contacts receive Insider Risk Management alerts for high-severity activity, that Conditional Access policies remain intact, and that triggering blocking of external sharing, signaling code-of-conduct violations, and requiring mailbox retention and legal search do not replace insider risk visibility—then verify a sample alert maps to a user activity investigation path.