SC-400 Audit and Monitoring 2

Question 1

An administrator needs to search audit logs for all activities performed by a specific user over the last 90 days. Which Microsoft Purview portal section should they use?

Accepted Answer

Audit (Standard)

Answer

Audit (Standard) in the Microsoft Purview compliance portal allows searching audit logs for user and admin activities up to 90 days.

Question 2

Which license is required to retain audit logs for up to one year with Microsoft Purview Audit (Premium)?

Accepted Answer

Microsoft 365 E5 or Microsoft 365 E5 Compliance add-on

Answer

Microsoft Purview Audit (Premium) with one-year retention requires Microsoft 365 E5 or the E5 Compliance add-on.

Question 3

A security team wants to be alerted whenever a user downloads more than 50 files from SharePoint within one hour. Which feature should they configure?

Accepted Answer

Alert policy in Microsoft Purview

Answer

Alert policies in Microsoft Purview can trigger notifications based on activity thresholds such as file downloads exceeding a defined count.

Question 4

What is the primary benefit of high-value audit events available in Microsoft Purview Audit (Premium)?

Accepted Answer

They provide granular mail access events like MailItemsAccessed for forensic investigation

Answer

Audit (Premium) includes high-value events such as MailItemsAccessed, which provide detailed forensic data for investigating email compromise.

Question 5

An organization wants to export audit log results for analysis in a SIEM tool. What file format does the Microsoft Purview audit log export produce?

Accepted Answer

CSV

Answer

Audit log search results in Microsoft Purview can be exported as a CSV file for use in external analysis tools.

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

SC-400 Audit and Monitoring 2