An analyst is investigating a possible account compromise. The Unified Audit Log shows that a user's account performed an administrative action in Exchange Online. The Azure AD sign-in log shows a successful sign-in from a new device. Which additional piece of information would best help the analyst determine if the action was legitimate?

The user's manager's approval history

The organization's Azure subscription ID

The IP address and user agent from the audit log record

An analyst is using Microsoft Graph to retrieve audit logs for a specific date range. The initial request returns a large number of records, and the analyst notices that the response includes a @odata.nextLink property. What should the analyst do to retrieve all the records?

Re-run the same request with a broader date range to capture all records.

Use the $skip parameter to skip the already retrieved records and re-run the request.

Follow the @odata.nextLink URL to request the next page of results.

Increase the $top parameter to a very large value to retrieve all records in one request.

A company has a regulatory requirement to retain audit logs for seven years. The default retention period for the Unified Audit Log is insufficient. The company uses Microsoft 365 E5 and needs to ensure that audit records are preserved for the required duration. What should the administrator configure?

Increase the storage quota of the mailbox that receives audit log notifications.

Enable a custom audit log retention policy in Microsoft Purview to retain audit logs for seven years.

Use the Azure Activity Log diagnostic settings to send audit logs to a storage account.

Export the audit logs to a CSV file and store them on a local file server.

GIAC Cloud Forensics Responder

Domain 5Objective 4

Microsoft Unified Audit Log and Graph API GCFR Practice Questions (Page 6)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

9concepts

Questions 26–30

26application · medium
An analyst is investigating a possible account compromise. The Unified Audit Log shows that a user's account performed an administrative action in Exchange Online. The Azure AD sign-in log shows a successful sign-in from a new device. Which additional piece of information would best help the analyst determine if the action was legitimate?
Select an answer first
27application · medium
An analyst is using Microsoft Graph to retrieve audit logs for a specific date range. The initial request returns a large number of records, and the analyst notices that the response includes a @odata.nextLink property. What should the analyst do to retrieve all the records?
Select an answer first
28application · medium
A company has a regulatory requirement to retain audit logs for seven years. The default retention period for the Unified Audit Log is insufficient. The company uses Microsoft 365 E5 and needs to ensure that audit records are preserved for the required duration. What should the administrator configure?
Select an answer first
29foundation · easy
When analyzing a Unified Audit Log entry, which field would you examine to determine the specific action that was performed?
Select an answer first
30foundation · easy
Which field in a Unified Audit Log record indicates the type of service or feature that generated the event?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Microsoft Unified Audit Log and Graph API GCFR Practice Questions (Page 6)

Questions 26–30

An analyst is using Microsoft Graph to retrieve audit logs for a specific date range. The initial request returns a large number of records, and the analyst notices that the response includes a @odata.nextLink property. What should the analyst do to retrieve all the records?

When analyzing a Unified Audit Log entry, which field would you examine to determine the specific action that was performed?

Which field in a Unified Audit Log record indicates the type of service or feature that generated the event?

Keep studying — Microsoft Azure Forensics