Exam SC-400 topic 5 question 23 discussion

When one event occurs which matches a policy, an alert is generated and displayed on the Alerts page and a notification is sent. If another event matching the same policy occurs within one minute of the first event, then Compliance Manager adds details about the additional event on the Events log tab of the existing alert instead of triggering a new alert. The goal of alert aggregation is to help reduce alert "fatigue" and let you focus and take action on fewer alerts. Taken from: https://learn.microsoft.com/en-us/purview/compliance-manager-alert-policies#alert-aggregation-for-multiple-events-within-one-minute By this logic, 2 alerts generated. The .xlsx will not generate an alert as it is not in scope of the policy.

Answer is 2 (no alert for xlsx file) When multiple events that match the conditions of an alert policy occur with one minute, they're added to an existing alert by a process called alert aggregation.

4 alerts, 1 for each file Filter is for .docx files. Dont be confused by the time, the trigger is Upload activity

There is interval of 1 minute for alert aggregation. https://learn.microsoft.com/en-us/purview/compliance-manager-alert-policies#alert-aggregation-for-multiple-events-within-one-minute Additionally, the XLSX file is filtered out.

Subscription Aggregation interval ****Office 365 or Microsoft 365 E5/G5 1 minute**** Defender for Office 365 Plan 2 1 minute E5 Compliance add-on or E5 Discovery and Audit add-on 1 minute Office 365 or Microsoft 365 E1/F1/G1 or E3/F3/G3 15 minutes Defender for Office 365 Plan 1 or Exchange Online Protection 15 minutes file 1 and 2 are 40 seconds apart = 1 alert file 4 and 5 are 30 seconds apart = 1 alert

When triggered alerts are within 5 mins then I think the answer should be 2. Because: File1.docx, File2.docx and File4.docx are in a range of 5 mins = 1 File3.xlsx ist not triggered File5.docx ist triggered at 08:05:10 and this is out of the initial triggered alert at 08:00:00 = +1 So I think the answer is B = 2

Answer is 1. As the alert triggered within 5 mins will be consolidated in a single alert.

D is the correct answer.

4 alerts, 1 for each file