What is the first step to query the Unified Audit Log in the Microsoft Purview compliance portal?

Navigate to the Audit page and select 'Search'

Open Azure Monitor and select 'Activity log'

Install the Microsoft Graph PowerShell module

Create a new data loss prevention policy

An analyst is using the Graph API to retrieve audit logs and needs to get only the records from the last 24 hours. The analyst wants to ensure the query is efficient and returns only the necessary data. Which query parameter should they use?

$filter with activityDateTime ge 2025-01-01T00:00:00Z

What is the primary role of the Microsoft Graph API in accessing audit and activity data?

It is used only for managing Azure virtual machines

It is a command-line tool for exporting audit logs to CSV

It provides a unified RESTful endpoint to query Microsoft 365 and Azure AD data, including audit logs

It replaces the need for any authentication when accessing audit data

A company needs to export Unified Audit Log records for a specific date range to provide to legal counsel. The export must include all records, including those from Exchange, SharePoint, and Azure AD. What is the most efficient way to export these records?

Use the Azure portal to export audit logs

Use PowerShell to export audit logs from each service individually

Use the Microsoft Purview compliance portal to search and export audit logs for the date range

Use the Graph API to query each service's audit logs separately

Which method can be used to export Unified Audit Log records for long-term storage?

Use Azure VM snapshots to capture the logs

Copy the logs from the local event viewer

Search the audit log and export results to a CSV file

Print the audit log from the portal

GIAC Cloud Forensics Responder

Domain 5Objective 4

Microsoft Unified Audit Log and Graph API GCFR Practice Questions (Page 7)

Part of the Microsoft Azure Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 6–9 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

9concepts

Questions 31–35

31foundation · easy
What is the first step to query the Unified Audit Log in the Microsoft Purview compliance portal?
Select an answer first
32application · medium
An analyst is using the Graph API to retrieve audit logs and needs to get only the records from the last 24 hours. The analyst wants to ensure the query is efficient and returns only the necessary data. Which query parameter should they use?
Select an answer first
33foundation · easy
What is the primary role of the Microsoft Graph API in accessing audit and activity data?
Select an answer first
34application · medium
A company needs to export Unified Audit Log records for a specific date range to provide to legal counsel. The export must include all records, including those from Exchange, SharePoint, and Azure AD. What is the most efficient way to export these records?
Select an answer first
35foundation · easy
Which method can be used to export Unified Audit Log records for long-term storage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.