MS-500 Research & Evidence-Based Practice 3 — Questions and Answers
Question 1: To investigate suspicious sign-in activity for a specific user in Azure AD, which log should an admin review first?
- Provisioning logs
- Audit logs
- Sign-in logs (Correct answer)
- Service health logs
Correct answer: Sign-in logs
Sign-in logs in Azure AD record each authentication attempt including location, device, risk level, and outcome.
Question 2: An admin wants to search the Microsoft 365 unified audit log using PowerShell. Which cmdlet should they use?
- Get-AuditLogEntry
- Search-UnifiedAuditLog (Correct answer)
- Get-AdminAuditLog
- Export-AuditLog
Correct answer: Search-UnifiedAuditLog
Search-UnifiedAuditLog is the PowerShell cmdlet used to query the Microsoft 365 unified audit log with date range and record type filters.
Question 3: What is the default audit log retention period for Microsoft 365 users with E3 licensing?
- 30 days
- 180 days
- 90 days (Correct answer)
- 1 year
Correct answer: 90 days
E3-licensed users have a 90-day default audit log retention; E5 or the Audit (Premium) add-on extends this to 1 year.
Question 4: In Microsoft Defender for Office 365, which feature allows an admin to investigate the complete delivery journey of a suspicious email including post-delivery location changes?
- Safe Attachments reports
- Quarantine dashboard
- Threat Explorer (Correct answer)
- Anti-phishing dashboard
Correct answer: Threat Explorer
Threat Explorer (and Real-time detections) provides full email delivery path analysis including ZAP actions that moved emails post-delivery.
Question 5: Which Microsoft Purview eDiscovery capability prevents mailbox content from being modified or deleted while a legal investigation is in progress?
- Content Search
- Litigation Hold (Correct answer)
- Retention policy
- Data loss prevention policy
Correct answer: Litigation Hold
Litigation Hold preserves all mailbox content indefinitely, overriding deletion and modification to ensure evidence integrity.
Question 6: Microsoft Defender for Identity (MDI) primarily analyzes which data source to detect lateral movement and identity-based attacks on-premises?
- Exchange Online mail flow logs
- Azure AD sign-in logs
- Domain controller event logs and network traffic (Correct answer)
- SharePoint file access logs
Correct answer: Domain controller event logs and network traffic
MDI sensors installed on domain controllers analyze Windows Event Logs and network traffic to detect attacks like Pass-the-Hash and Kerberoasting.
Question 7: Which Microsoft Purview capability enables admins to run keyword and condition-based searches across Exchange, SharePoint, and Teams data for compliance investigations?
- Compliance Manager
- Content search (Correct answer)
- Insider risk management
- Communication compliance
Correct answer: Content search
Content search in Microsoft Purview allows cross-service searches using keywords, date ranges, senders, and other conditions to locate relevant data.
MS-500 Research & Evidence-Based Practice 3
To investigate suspicious sign-in activity for a specific user in Azure AD, which log should an admin review first?