SC-400 Audit and Monitoring 4

Question 1

A company must demonstrate that no admin has accessed a sensitive SharePoint site in the past 6 months. Which audit feature best supports this?

Accepted Answer

Audit log search filtered by site URL and admin accounts

Answer

Audit log search can be filtered by specific SharePoint site URLs and user accounts to produce a report of all access events.

Question 2

What does the RecordType field in a Microsoft 365 audit log entry indicate?

Accepted Answer

The Microsoft 365 service or feature that generated the event

Answer

The RecordType field identifies which Microsoft 365 workload or feature produced the audit event, such as SharePoint, Exchange, or Azure AD.

Question 3

Which Microsoft 365 feature enables administrators to receive daily email digests of high-risk activities detected by default alert policies?

Accepted Answer

Default alert policies with email notification configured

Answer

Default alert policies in Microsoft Purview can be configured to send email notifications to admins when triggered by predefined high-risk activities.

Question 4

An insider risk investigator needs to correlate audit data with user behavior analytics. Which Microsoft Purview solution provides this integration natively?

Accepted Answer

Insider Risk Management

Answer

Microsoft Purview Insider Risk Management natively ingests audit signals and applies machine learning to identify risky user behavior patterns.

Question 5

When using Search-UnifiedAuditLog in PowerShell, what is the maximum number of records returned per call?

Accepted Answer

50000

Answer

Search-UnifiedAuditLog returns up to 5,000 results per call; pagination using the SessionId and SessionCommand parameters is needed for larger result sets.

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

SC-400 Audit and Monitoring 4