SC-400 Audit and Monitoring 5 — Questions and Answers
Question 1: Which Microsoft Purview Audit (Premium) capability allows organizations to retain specific audit log records for 10 years?
- Default audit retention policy extended mode
- 10-year audit log retention add-on with custom retention policy (Correct answer)
- Litigation Hold applied to user mailboxes
- Microsoft 365 Archive feature
Correct answer: 10-year audit log retention add-on with custom retention policy
The 10-year audit log retention add-on, combined with a custom audit retention policy, enables retention up to 10 years for regulatory compliance.
Question 2: A compliance team wants to track changes to sensitivity labels applied to documents in SharePoint. Which audit activity category should they monitor?
- File and page activities
- Sensitivity label activities (Correct answer)
- Sharing and access request activities
- Site administration activities
Correct answer: Sensitivity label activities
Sensitivity label activities in the audit log capture events such as label applied, label changed, and label removed from files and emails.
Question 3: An organization uses Microsoft Sentinel for SIEM. What is the recommended method to ingest Microsoft Purview audit logs into Sentinel?
- Manual CSV export and upload
- Microsoft 365 Defender data connector in Microsoft Sentinel (Correct answer)
- Direct SQL connection to audit database
- Scheduled PowerShell script emailing CSV attachments
Correct answer: Microsoft 365 Defender data connector in Microsoft Sentinel
The Microsoft 365 Defender (or Office 365) data connector in Microsoft Sentinel enables automated ingestion of audit log data for threat analysis.
Question 4: Which audit log event would indicate that an admin created a new eDiscovery case in Microsoft Purview?
- CaseAdded under eDiscovery activities (Correct answer)
- FileUploaded under SharePoint activities
- PolicyCreated under DLP activities
- HoldCreated under Exchange activities
Correct answer: CaseAdded under eDiscovery activities
The CaseAdded event under eDiscovery activities in the audit log records when a new eDiscovery case is created by an administrator.
Question 5: A user reports they did not delete a file, but the audit log shows a Delete event under their account. What should an investigator check first?
- Whether the file was in a retention policy scope
- Whether another user or process had delegated access or acted as the user (Correct answer)
- Whether the SharePoint site had versioning enabled
- Whether the file had a sensitivity label applied
Correct answer: Whether another user or process had delegated access or acted as the user
Delegated permissions or service accounts acting on behalf of a user can appear as that user's activity in audit logs, requiring investigation of delegated access.
Question 6: Which Microsoft Purview feature should be used to investigate whether a DLP policy match was correctly triggered for a specific file?
- Audit log search for DLPRuleMatch activities (Correct answer)
- Content Search with keyword query
- Compliance Manager assessment
- Communication Compliance review queue
Correct answer: Audit log search for DLPRuleMatch activities
Searching for DLPRuleMatch activity type in the audit log shows detailed records of when DLP rules matched content, including which policy and rule fired.
Question 7: An administrator wants to ensure audit log search is enabled for their tenant. Which PowerShell cmdlet confirms the current audit log status?
- Get-OrganizationConfig | Select-Object UnifiedAuditLogIngestionEnabled (Correct answer)
- Get-AuditLogConfig
- Test-UnifiedAuditLog
- Get-ComplianceConfiguration
Correct answer: Get-OrganizationConfig | Select-Object UnifiedAuditLogIngestionEnabled
Get-OrganizationConfig with the UnifiedAuditLogIngestionEnabled property shows whether audit log ingestion is currently active for the tenant.
SC-400 Audit and Monitoring 5
Which Microsoft Purview Audit (Premium) capability allows organizations to retain specific audit log records for 10 years?