SC-400 Audit and Monitoring 5

Question 1

Which Microsoft Purview Audit (Premium) capability allows organizations to retain specific audit log records for 10 years?

Accepted Answer

10-year audit log retention add-on with custom retention policy

Answer

The 10-year audit log retention add-on, combined with a custom audit retention policy, enables retention up to 10 years for regulatory compliance.

Question 2

A compliance team wants to track changes to sensitivity labels applied to documents in SharePoint. Which audit activity category should they monitor?

Accepted Answer

Sensitivity label activities

Answer

Sensitivity label activities in the audit log capture events such as label applied, label changed, and label removed from files and emails.

Question 3

An organization uses Microsoft Sentinel for SIEM. What is the recommended method to ingest Microsoft Purview audit logs into Sentinel?

Accepted Answer

Microsoft 365 Defender data connector in Microsoft Sentinel

Answer

The Microsoft 365 Defender (or Office 365) data connector in Microsoft Sentinel enables automated ingestion of audit log data for threat analysis.

Question 4

Which audit log event would indicate that an admin created a new eDiscovery case in Microsoft Purview?

Accepted Answer

CaseAdded under eDiscovery activities

Answer

The CaseAdded event under eDiscovery activities in the audit log records when a new eDiscovery case is created by an administrator.

Question 5

A user reports they did not delete a file, but the audit log shows a Delete event under their account. What should an investigator check first?

Accepted Answer

Whether another user or process had delegated access or acted as the user

Answer

Delegated permissions or service accounts acting on behalf of a user can appear as that user's activity in audit logs, requiring investigation of delegated access.

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

SC-400 Audit and Monitoring 5