Investigate Microsoft 365 Activities to Identify Threats SC-200 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of Content search in Microsoft Purview eDiscovery?

   • ATo search for content across mailboxes, SharePoint sites, and other data sources
   • BTo manage user permissions
   • CTo configure data loss prevention policies
   • DTo monitor user activity in real time
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary role of Microsoft Graph activity logs in threat investigation?

   • ATo manage user authentication tokens
   • BTo provide real-time threat blocking
   • CTo store email content for eDiscovery
   • DTo provide a record of API calls and administrative actions in Microsoft 365
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   You are investigating a possible account compromise. You need to find all audit log entries where a user performed 'MailboxLogin' or 'SendMail' activities in the last 24 hours. You are using the Microsoft Purview audit log search. What is the most efficient way to filter the results?

   • ARun two separate searches, one for each activity.
   • BUse a Content search query for 'MailboxLogin' and 'SendMail'.
   • CUse the Activities filter and select both 'MailboxLogin' and 'SendMail' from the list.
   • DSearch for the user's name and manually review all results.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   You are analyzing Microsoft Graph activity logs and notice that a service principal is making 'Group.Read.All' calls at a much higher rate than usual. The service principal is used by a legitimate application. You need to determine if the activity is malicious. What should you do?

   • AIgnore the activity because the application is legitimate.
   • BCompare the current call volume to the application's historical baseline and review the permissions granted to the service principal.
   • CRun a Content search for the groups accessed by the service principal.
   • DDisable the service principal immediately to stop the activity.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following activities would be recorded in the Microsoft Purview Audit log?

   • AA user changing their personal profile picture
   • BA user downloading a file from SharePoint Online
   • CA user performing a local backup of their device
   • DA user sending a direct message in Teams
   Reveal Solution Discussion Select an answer first