SC-200 - Respond to Security Incidents (37% of the exam) - Section 2.7

Investigate Microsoft 365 activities to identify threats using Microsoft Purview Audit, Content Search, and Microsoft Graph activity logs.

Search Microsoft 365 user and admin activity using Audit from Microsoft Purview and Content Search to surface relevant evidence during an investigation. Supplement these sources with Microsoft Graph activity logs, and understand how audit log retention policies affect how far back records are available.

Audit from Microsoft PurviewContent Search in Microsoft PurviewMicrosoft Graph activity logsaudit log retention

Practice question for this objective

Free sampleRespond to Security Incidentsmedium

A security analyst needs to investigate a suspected account compromise by reviewing what a user did across Exchange Online and SharePoint Online over the past week. The analyst wants the activity trail, including the operation name, the timestamp, and the target object for each action, and intends to filter the results by user and by activity type. The tenant has the default Microsoft Purview Audit (Standard) configuration. Which Microsoft Purview Audit capability should the analyst use to retrieve this cross-workload activity trail?

ACreate a Content Search in Microsoft Purview, scoping the search to the user's mailbox and OneDrive with a keyword that matches the suspicious actions.
BQuery the Microsoft Graph activity logs to read the per-request HTTP telemetry that the user's Microsoft 365 apps generated during the period of interest.
COpen an eDiscovery (Premium) case and add the user as a custodian to collect the audit activity for review and legal hold.
DRun an audit search in Microsoft Purview Audit against the unified audit log, filtering by the user, the date range, and the activities of interest. Correct

Use an audit search against the unified audit log in Microsoft Purview Audit to retrieve cross-workload user activity trails filtered by user, date, and activity. The unified audit log in Microsoft Purview Audit aggregates operations from Exchange Online, SharePoint Online, and other Microsoft 365 workloads, recording the operation, timestamp, actor, and target. An audit search filtered by user, date range, and activity returns precisely this activity trail, whereas Content Search and Graph activity logs serve different purposes.

Why A is wrong: Content Search finds and exports item contents such as messages and documents, but it does not return an audit trail of operations, timestamps, and target objects, so it cannot answer what the user did.

Why B is wrong: Microsoft Graph activity logs capture API request-level telemetry from applications calling Graph, not the user-facing Exchange and SharePoint operations recorded as audited activities, so they do not give this activity trail.

Why C is wrong: eDiscovery (Premium) preserves and collects content for legal matters and custodian management, which is heavier than needed and still does not produce the operation-level audit trail an audit search returns.

Why D is correct: Microsoft Purview Audit records operations from Exchange Online, SharePoint Online, and other workloads in the unified audit log, and an audit search filtered by user, date, and activity returns exactly this cross-workload activity trail.

See more SC-200 practice questions, answers explained.

Exam traps in Respond to Security Incidents

Answers that look right on this material and are not. Each one is a distractor from a different question in the SC-200 bank for this domain.

Audit (Standard) retains audit records for the default period of one year, so events from 14 months ago have aged out, and a longer window would simply need Audit (Standard) reconfigured with a custom policy.
Why it is wrong: A one-year default is wrong: one year is the Audit (Premium) default, not Audit (Standard), and Audit (Standard) cannot be reconfigured with a custom retention policy, so this misstates the product capability.
Run a Content Search scoped to the affected mailbox so the older activity can be recovered from the audit data already held in the tenant.
Why it is wrong: Content Search locates and exports item contents such as messages and documents; it does not read or extend the unified audit log, so it cannot recover expired audit events or change how long they are kept.
Use Microsoft Graph activity logs to retrieve the user's Microsoft 365 activity trail with each operation, its timestamp, and the target item.
Why it is wrong: Graph activity logs capture an application's HTTP API requests, not the user-level Exchange and SharePoint activity trail the audit log provides.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.