Exam SC-400 topic 2 question 80 discussion

Is the answer correct Y/N/Y ? Please advise.

Last one is Y, as setting the severity level to high is part of the guidelines and not a requirement. It's to decrease incident report alert noise. When using a Data leaks template, you "can" assign a DLP policy to trigger indicators in the insider risk policy for "high severity alerts" in your organization. Data leaks policy guidelines When creating or modifying data loss prevention policies for use with insider risk management policies, consider the following guidelines: Prioritize data exfiltration events and be selective when assigning Incident reports settings to High when configuring rules in your DLP policies. For example, emailing sensitive documents to a known competitor should be a High alert level exfiltration event. Over-assigning the High level in the Incident reports settings in other DLP policy rules can increase the noise in the insider risk management alert workflow and make it more difficult for your data investigators and analysts to properly evaluate these alerts. https://learn.microsoft.com/en-us/purview/insider-risk-management-policy-templates#data-leaks