Exam SC-900 topic 1 question 109 discussion

Looks correct following the docs. https://learn.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management?view=o365-worldwide#workflow

Same as Question 155. https://www.examtopics.com/discussions/microsoft/view/93683-exam-sc-900-topic-1-question-155-discussion

1. Triage 2. Investigate 3. Action https://learn.microsoft.com/en-us/training/modules/describe-insider-risk-capabilities-microsoft-365/2-management-solution Triage - New activities that need investigation automatically generate alerts that are assigned a Needs review status. Reviewers in the organization can quickly identify these alerts and scroll through each to evaluate and triage. As part of the triage process, reviewers can view alert details for the policy match, view user activity associated with the match, see the severity of the alert, and review user profile information. Investigate - Cases are created for alerts that require deeper review and investigation of the details and circumstances around the policy match. The Case dashboard provides an all-up view of all active cases, open cases over time, and case statistics for the organization. Action - After cases are investigated, reviewers can quickly act to resolve the case or collaborate with other risk stakeholders in the organization.

Correct. https://learn.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management?view=o365-worldwide