A security team is building a script to retrieve all audit log records from the last 24 hours using Microsoft Graph. The script currently uses the /auditLogs/directoryAudits endpoint and handles pagination by following the @odata.nextLink. However, the script is missing some records. The team suspects that the issue is related to the way the script filters by date. Which approach should the team use to ensure complete retrieval?

Use $top with a very large value to retrieve all records in one request.

Use the /auditLogs/signIns endpoint instead, as it provides more complete coverage.

Use a single $filter with activityDateTime ge and lt for the exact 24-hour window, and ensure the script follows all nextLink pages.

Use multiple $filter parameters, one for the start date and one for the end date.

A developer is creating an application that will read audit logs from Microsoft Graph. The application will run as a daemon and use the client credentials flow. Which permission should the developer grant to the application in Azure AD?

Mail.Read (application permission)

Directory.Read.All (application permission)

User.Read (delegated permission)

AuditLog.Read.All (application permission)

An analyst is investigating a suspicious email deletion in Exchange Online. The Unified Audit Log shows an operation 'SoftDelete' for a mailbox item. The analyst wants to determine if the deletion was performed by the user or by an administrator. Which additional field or data source should the analyst examine?

The 'ClientIP' field to see the IP address of the deletion

The 'RecordType' field to see if it is Exchange or Azure AD

The 'UserId' field in the audit record to see who performed the deletion

The 'Operation' field to see if it is 'SoftDelete' or 'HardDelete'

A compliance officer needs to ensure that audit logs are retained for at least 1 year. The default retention period is 180 days. The officer wants to configure this in the Microsoft Purview compliance portal. What should they do?

Export all audit logs to a CSV file and store them for 1 year

Enable audit log search and set the retention period to 1 year

Create a new audit retention policy with a duration of 1 year

Use the Graph API to set the retention period

GIAC Cloud Forensics Responder

Domain 5Objective 4

Microsoft Unified Audit Log and Graph API GCFR Practice Questions (Page 5)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

9concepts

Questions 21–25

21expert · hard
A security team is building a script to retrieve all audit log records from the last 24 hours using Microsoft Graph. The script currently uses the /auditLogs/directoryAudits endpoint and handles pagination by following the @odata.nextLink. However, the script is missing some records. The team suspects that the issue is related to the way the script filters by date. Which approach should the team use to ensure complete retrieval?
Select an answer first
22application · medium
A developer is creating an application that will read audit logs from Microsoft Graph. The application will run as a daemon and use the client credentials flow. Which permission should the developer grant to the application in Azure AD?
Select an answer first
23expert · medium
An analyst is investigating a suspicious email deletion in Exchange Online. The Unified Audit Log shows an operation 'SoftDelete' for a mailbox item. The analyst wants to determine if the deletion was performed by the user or by an administrator. Which additional field or data source should the analyst examine?
Select an answer first
24application · medium
A compliance officer needs to ensure that audit logs are retained for at least 1 year. The default retention period is 180 days. The officer wants to configure this in the Microsoft Purview compliance portal. What should they do?
Select an answer first
25application · medium
An analyst is reviewing a Unified Audit Log entry for a SharePoint file download. The entry shows the Operation as "FileDownloaded" and the UserId as "user@contoso.com". The analyst wants to determine the source IP address of the download. Which field in the audit record should the analyst examine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Microsoft Unified Audit Log and Graph API GCFR Practice Questions (Page 5)

Questions 21–25

A developer is creating an application that will read audit logs from Microsoft Graph. The application will run as a daemon and use the client credentials flow. Which permission should the developer grant to the application in Azure AD?

A compliance officer needs to ensure that audit logs are retained for at least 1 year. The default retention period is 180 days. The officer wants to configure this in the Microsoft Purview compliance portal. What should they do?

An analyst is reviewing a Unified Audit Log entry for a SharePoint file download. The entry shows the Operation as "FileDownloaded" and the UserId as "user@contoso.com". The analyst wants to determine the source IP address of the download. Which field in the audit record should the analyst examine?

Keep studying — Microsoft Azure Forensics