Question
You have a Microsoft 365 E5 tenant.
You need to ensure that administrators are notified when a user receives an email message that contains malware. The solution must use the principle of least privilege.
Which type of policy should you create, and which Microsoft Purview solutions role is required to create the policy? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
For Policy type, select Alert. An alert policy watches for an activity such as malware being detected in an email message and sends an email notification to the recipients you list, which is exactly the notification the administrators need. Threat policies filter and act on mail but are not the feature that notifies administrators of an event, and compliance policies deal with data governance. For Role, select Security Administrator. Creating an alert policy requires the Manage Alerts role, which the Security Administrator role group includes, and that group can also see alerts in the Threat management category. Organization Management also contains Manage Alerts but adds many unrelated permissions, including managing role groups, so it breaks least privilege, while Quarantine Administrator and Communication Compliance Administrators do not include Manage Alerts.
