Investigate Microsoft 365 Activities to Identify Threats SC-200 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   You need to investigate a security incident where a user's mailbox was accessed by an unknown actor. You need to determine what actions the actor performed in the mailbox. What should you do?

   • AReview Azure AD sign-in logs for the user.
   • BRun a Content search in eDiscovery for the mailbox contents.
   • CCheck Microsoft Graph activity logs for mailbox operations.
   • DSearch the Microsoft Purview audit log for mailbox activities by the user.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   Your organization uses Microsoft Graph to manage devices. You need to investigate a potential compromise where an attacker used a stolen token to call the Graph API to modify device settings. What should you do?

   • ASearch Microsoft Graph activity logs for 'Update device' operations and correlate with token issuance events.
   • BRun a Content search for device settings.
   • CReview Azure AD sign-in logs for the device.
   • DSearch the Microsoft Purview audit log for device modifications.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Your organization is required to retain audit logs for at least one year to meet compliance obligations. You are using Microsoft Purview Audit (Standard). What should you do to meet the retention requirement?

   • AIncrease the retention policy in the audit log settings.
   • BUse Content search to preserve audit logs.
   • CEnable Microsoft Purview Audit (Premium) for your organization.
   • DExport all audit logs to a local file daily.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   Your organization uses Microsoft Graph APIs to automate file synchronization. You suspect that a compromised application is making excessive API calls to read user profiles. You need to investigate the API activity. What should you do?

   • ARun an eDiscovery Content search for the application's registration details.
   • BSearch the Microsoft Purview audit log for the application's sign-in events.
   • CReview the Azure AD sign-in logs for the application's service principal.
   • DAccess the Microsoft Graph activity logs and filter for the application ID and the User.Read operation.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which role is required to search the Microsoft Purview audit log?

   • AAudit Logs
   • BGlobal Reader
   • CSecurity Reader
   • DCompliance Administrator
   Reveal Solution Discussion Select an answer first