Investigate Microsoft 365 Activities to Identify Threats SC-200 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   Your organization has enabled Microsoft Graph activity logs. You need to analyze the logs to identify which applications are making excessive API calls. You have access to the logs in your SIEM. What is the most effective way to identify the top calling applications?

   • AQuery the Graph activity logs and group by the 'appId' field.
   • BReview Azure AD sign-in logs for application sign-ins.
   • CUse Content search to find application usage reports.
   • DSearch the audit log for application registration events.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In the Microsoft Purview portal, where would you go to access the audit log search tool?

   • ASolutions > eDiscovery
   • BRoles & scopes > Audit roles
   • CSolutions > Audit
   • DData classification > Overview
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   During an investigation, you need to find all emails in a user's mailbox that contain the phrase 'invoice' and were sent to a specific external domain in the last 30 days. You have the required eDiscovery permissions. What should you use?

   • AContent search in Microsoft Purview eDiscovery with a KQL query for the keyword and recipient domain.
   • BAzure AD sign-in logs for the user's recent activity.
   • CMicrosoft Graph activity logs filtered by the user's mailbox events.
   • DMicrosoft Purview Audit log search with a query for 'invoice' and the external domain.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of Microsoft Purview Audit in the context of threat investigation?

   • ATo automatically block malicious activities in real time
   • BTo manage user permissions and roles in Microsoft 365
   • CTo provide a unified log of user and admin activities across Microsoft 365 services for forensic analysis
   • DTo store email content and attachments for eDiscovery
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   You are a security analyst and need to investigate a potential data exfiltration incident involving a user downloading a large number of files from SharePoint Online. You have been granted the 'View-Only Audit Logs' role. What is the first step to access the relevant audit records?

   • AUse Microsoft Graph activity logs to find the downloads.
   • BNavigate to Microsoft Purview portal > Audit and run a search for SharePoint file download activities.
   • CRun a Content search in eDiscovery for the downloaded files.
   • DCheck Azure AD sign-in logs for the user's session.
   Reveal Solution Discussion Select an answer first