HR flags unusual mass downloads by a departing public-works employee, while another team only wants to stop Social Security numbers from leaving in email. How should the city distinguish insider risk from DLP?
Select an answer to reveal the explanation.
Short Explanation
One story is about what people are doing that looks sketchy. The other is about what sensitive data is trying to leave. Insider risk watches behavior; DLP watches the content.
Full Explanation
Microsoft Purview insider risk management emphasizes risky user activities and behavioral indicators. Data loss prevention emphasizes detecting and controlling sharing of sensitive information types. Municipal teams should not treat the two as interchangeable product purposes on MS-900.