Which of the following data sources can be included in a Content search?

Azure Active Directory sign-in logs

Your organization has enabled Microsoft Graph activity logs. You need to investigate a possible data exfiltration where an attacker used a compromised service principal to call the Microsoft Graph API to download user emails. What should you do?

Review the Azure AD sign-in logs for the service principal's sign-ins.

Run a Content search for emails accessed by the service principal.

Use the Microsoft Purview audit log to search for 'Mail.Read' activities.

Use the Microsoft Graph activity log to search for requests from the service principal ID and filter for the 'Mail.Read' operation.

You are investigating a security incident where an attacker used a compromised application to call the Microsoft Graph API to read user profiles. You need to identify the specific API calls made and the data accessed. What should you do?

Run a Content search for the user profiles accessed.

Access Microsoft Graph activity logs and filter for the application ID and the 'User.Read' operation, then review the response codes and data accessed.

Review Azure AD sign-in logs for the application's sign-ins.

Search the Microsoft Purview audit log for 'User.Read' activities.

Your organization uses a custom application that calls Microsoft Graph APIs to read user profiles. You suspect that a compromised token is being used to make unusual API calls. Which log source should you analyze to identify the specific API requests and their originating IP addresses?

Content search in eDiscovery for application data.

Microsoft Purview Audit log for application events.

Microsoft Certified:Security Operations Analyst Associate

Domain 2Objective 3

Investigate Microsoft 365 Activities to Identify Threats SC-200 Practice Questions (Page 5)

Part of the Respond to security incidents domain, which accounts for 35–40% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~14–26 in this domain), expect 5–9 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

35–40%of the exam

Questions 21–25

21foundation · easy
Which query syntax would you use in Content search to find emails sent by a specific user?
Select an answer first
22foundation · easy
Which of the following data sources can be included in a Content search?
Select an answer first
23application · medium
Your organization has enabled Microsoft Graph activity logs. You need to investigate a possible data exfiltration where an attacker used a compromised service principal to call the Microsoft Graph API to download user emails. What should you do?
Select an answer first
24expert · hard
You are investigating a security incident where an attacker used a compromised application to call the Microsoft Graph API to read user profiles. You need to identify the specific API calls made and the data accessed. What should you do?
Select an answer first
25application · medium
Your organization uses a custom application that calls Microsoft Graph APIs to read user profiles. You suspect that a compromised token is being used to make unusual API calls. Which log source should you analyze to identify the specific API requests and their originating IP addresses?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.