MS-500 Research & Evidence-Based Practice 3

Question 1

To investigate suspicious sign-in activity for a specific user in Azure AD, which log should an admin review first?

Accepted Answer

Sign-in logs

Answer

Sign-in logs in Azure AD record each authentication attempt including location, device, risk level, and outcome.

Question 2

An admin wants to search the Microsoft 365 unified audit log using PowerShell. Which cmdlet should they use?

Accepted Answer

Search-UnifiedAuditLog

Answer

Search-UnifiedAuditLog is the PowerShell cmdlet used to query the Microsoft 365 unified audit log with date range and record type filters.

Question 3

What is the default audit log retention period for Microsoft 365 users with E3 licensing?

Accepted Answer

90 days

Answer

E3-licensed users have a 90-day default audit log retention; E5 or the Audit (Premium) add-on extends this to 1 year.

Question 4

In Microsoft Defender for Office 365, which feature allows an admin to investigate the complete delivery journey of a suspicious email including post-delivery location changes?

Accepted Answer

Threat Explorer

Answer

Threat Explorer (and Real-time detections) provides full email delivery path analysis including ZAP actions that moved emails post-delivery.

Question 5

Which Microsoft Purview eDiscovery capability prevents mailbox content from being modified or deleted while a legal investigation is in progress?

Accepted Answer

Litigation Hold

Answer

Litigation Hold preserves all mailbox content indefinitely, overriding deletion and modification to ensure evidence integrity.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Research & Evidence-Based Practice 3