In the Microsoft 365 admin center, which step is part of assigning a Purview Audit (Premium) license to a user?

Add the user to the 'Audit Logs' admin role in Microsoft Purview.

Create a new audit log retention policy and apply it to the user.

Select the user, then choose 'Manage product licenses' and assign a license that includes Audit (Premium).

Enable the 'Audit enabled' toggle in the user's mailbox properties.

A security administrator is investigating a potential data breach where a user may have accessed sensitive files in SharePoint Online. The investigation requires audit logs for the past 18 months. The organization has Microsoft Purview Audit (Standard) enabled for all users, and the administrator has already assigned Audit (Premium) licenses to the user under investigation. However, the audit log search only returns events from the past 180 days. What is the most likely reason for this issue?

The audit log retention policy is set to 180 days, and a custom retention policy needs to be configured to extend the retention period.

The user's activities are not being logged because the user does not have the correct role in Microsoft Purview.

The audit log search is limited to the last 180 days by default, and the administrator needs to use a different search tool.

The user's Audit (Premium) license is not yet active, and the administrator needs to wait for the license to propagate.

Contoso's compliance team needs to retain audit logs for 2 years for users in the finance department, but only 90 days for other users. They have Microsoft 365 E5 licenses. What should they configure?

Enable litigation hold for finance users to preserve audit logs for 2 years.

Use eDiscovery holds to retain audit logs for finance users.

Create two custom audit retention policies: one for finance users with 2-year retention and one for all other users with 90-day retention.

Assign Microsoft 365 E5 licenses to finance users to extend retention to 2 years.

A user in the finance department is suspected of accessing sensitive customer records outside of normal business hours. The security team needs to determine what specific actions the user performed in SharePoint Online over the past 90 days, including file views and downloads. The organization currently has Microsoft Purview Audit (Standard) enabled for all users. What should the security administrator do first to ensure the investigation can proceed?

Assign the user a Microsoft Purview Audit (Premium) license and then search the audit log for the user's activities.

Use the Activity Explorer to view the user's activities, as it provides a direct view of all user actions without needing additional licenses.

Search the audit log immediately using the existing Audit (Standard) license, as it logs all SharePoint activities.

Create a custom audit retention policy for the finance department before searching the audit log.

A DLP alert is triggered in Microsoft Purview when a user attempts to share a document containing credit card numbers with an external email address. The security team needs to respond to the alert and prevent further sharing of the document. What is the most appropriate immediate action?

Immediately delete the user's account to prevent any further sharing.

Investigate the alert in the Microsoft Purview portal, review the activity details, and then apply a DLP policy action to block the sharing.

Use Activity Explorer to find the document and manually remove the external sharing link.

Create a new insider risk policy to monitor the user's future activities.

Microsoft Certified:Information Security Administrator Associate

Domain 3Objective 2

Manage Information Security Alerts and Activities SC-401 Practice Questions (Page 3)

Part of the Manage risks, alerts, and activities domain, which accounts for 30–35% of the SC-401 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 4–8 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

9concepts

30–35%of the exam

Questions 11–15

11foundation · easy
In the Microsoft 365 admin center, which step is part of assigning a Purview Audit (Premium) license to a user?
Select an answer first
12expert · hard
A security administrator is investigating a potential data breach where a user may have accessed sensitive files in SharePoint Online. The investigation requires audit logs for the past 18 months. The organization has Microsoft Purview Audit (Standard) enabled for all users, and the administrator has already assigned Audit (Premium) licenses to the user under investigation. However, the audit log search only returns events from the past 180 days. What is the most likely reason for this issue?
Select an answer first
13application · medium
Contoso's compliance team needs to retain audit logs for 2 years for users in the finance department, but only 90 days for other users. They have Microsoft 365 E5 licenses. What should they configure?
Select an answer first
14application · medium
A user in the finance department is suspected of accessing sensitive customer records outside of normal business hours. The security team needs to determine what specific actions the user performed in SharePoint Online over the past 90 days, including file views and downloads. The organization currently has Microsoft Purview Audit (Standard) enabled for all users. What should the security administrator do first to ensure the investigation can proceed?
Select an answer first
15application · medium
A DLP alert is triggered in Microsoft Purview when a user attempts to share a document containing credit card numbers with an external email address. The security team needs to respond to the alert and prevent further sharing of the document. What is the most appropriate immediate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-401” is a trademark of its owner, used for identification only.

Manage Information Security Alerts and Activities SC-401 Practice Questions (Page 3)

Questions 11–15

In the Microsoft 365 admin center, which step is part of assigning a Purview Audit (Premium) license to a user?

Contoso's compliance team needs to retain audit logs for 2 years for users in the finance department, but only 90 days for other users. They have Microsoft 365 E5 licenses. What should they configure?

A DLP alert is triggered in Microsoft Purview when a user attempts to share a document containing credit card numbers with an external email address. The security team needs to respond to the alert and prevent further sharing of the document. What is the most appropriate immediate action?

Keep studying — Manage risks, alerts, and activities