SC-400 Audit and Monitoring 3

Question 1

A compliance officer needs audit log data retained for 5 years to meet regulatory requirements. Which Microsoft Purview Audit (Premium) feature supports this?

Accepted Answer

Custom audit retention policy with 5-year duration

Answer

Custom audit retention policies in Audit (Premium) allow organizations to retain audit logs for up to 10 years with appropriate licensing.

Question 2

Which workloads are covered by the Microsoft 365 unified audit log? (Select the best answer)

Accepted Answer

Exchange Online, SharePoint Online, OneDrive, Teams, and Azure AD

Answer

The unified audit log captures events across Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, Azure AD, and other Microsoft 365 services.

Question 3

A security analyst notices audit records are missing for the period when a suspected breach occurred. What is the most likely reason?

Accepted Answer

Auditing was not enabled during that period

Answer

If auditing was disabled during the breach window, no records would exist for that period, creating gaps in the audit trail.

Question 4

Which Microsoft Purview feature allows you to stream audit log data in near real-time to Azure services like Event Hub or Storage?

Accepted Answer

Microsoft Purview Audit streaming via Office 365 Management Activity API

Answer

The Office 365 Management Activity API enables near real-time streaming of audit events to external systems such as Azure Event Hub or Storage.

Question 5

When configuring an audit log search, which date/time zone do the start and end times correspond to?

Accepted Answer

UTC (Coordinated Universal Time)

Answer

All audit log timestamps in Microsoft Purview use UTC, so search date/time parameters must be specified in UTC.

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

SC-400 Audit and Monitoring 3