Microsoft Unified Audit Log and Graph API GCFR Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of the Microsoft Unified Audit Log in Microsoft 365 and Azure?

   • ATo provide real-time streaming of all network traffic within an organization
   • BTo provide a single searchable log of user and admin activities across Microsoft 365 services and Azure AD
   • CTo replace Azure Monitor and Application Insights for telemetry collection
   • DTo store only Azure resource manager operations for compliance reporting
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which data sources contribute events to the Microsoft Unified Audit Log?

   • AMicrosoft 365 services such as Exchange Online, SharePoint Online, and Azure AD
   • BOnly Azure subscription-level activity logs from Azure Resource Manager
   • COnly Azure virtual machines and their guest operating system logs
   • DOnly security alerts from Microsoft Defender for Cloud
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An analyst is investigating a potential data exfiltration incident. The Unified Audit Log shows that a user accessed a file in SharePoint, and the Azure AD sign-in log shows a successful sign-in from an unusual IP address at the same time. Which additional data source would best help the analyst determine whether the file was actually downloaded or just viewed?

   • AThe user's manager's sign-in logs
   • BThe detailed properties of the audit log record, such as the operation name and the item's file name
   • CThe user's mailbox audit log
   • DThe Azure Activity Log for the SharePoint site
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which field in an audit log record provides the timestamp of when the activity occurred?

   • AUserId
   • BRecordType
   • CCreationTime
   • DOperation
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An analyst is investigating a data breach where a user's credentials were compromised. The Unified Audit Log shows that the user accessed a sensitive file in SharePoint, and the Azure AD sign-in log shows a successful sign-in from an unusual location. The analyst also finds that the user's account has been disabled. Which additional step should the analyst take to determine the full scope of the breach?

   • AReview the user's manager's sign-in logs to see if the manager was also compromised.
   • BReview the user's mailbox for any emails sent during the compromise window.
   • CReview all audit log entries for the user's account, including failed sign-ins and other file accesses, to identify all actions taken during the compromise window.
   • DReview the Azure Activity Log for the SharePoint site to see if any configuration changes were made.
   Reveal Solution Discussion Select an answer first