Question 610 The insurance provider SOC needs to identify who deleted a sensitive SharePoint document and when, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Audit searches reconstruct logged operations rather than document content itself. Appropriate scope reduces unrelated private data and improves review. Audit log duration does not preserve the underlying mailbox item. Audit records support activity reconstruction across applicable workloads. Explanation Correct Answer A:Audit searches reconstruct logged operations rather than document content itself. Incorrect Answers B:Narrowing a large evidence search to relevant custodians and date ranges does not identify who deleted a sensitive SharePoint document and when. C:Avoiding confusing retention of audit records with retention of messages does not identify who deleted a sensitive SharePoint document and when. D:Correlating multiple suspicious file downloads by the same user over time does not identify who deleted a sensitive SharePoint document and when.
Question 611 A Purview Audit search finds no file-deletion event, but the user still has the deleted file in an eDiscovery result. Why do these observations not contradict each other? eDiscovery results automatically reconstruct every historical user action The deleted file must be a synthetic record created by Sentinel Audit availability and search retention/scope differ from content preservation; a retained file can exist without the searched audit event Any retained document proves that no deletion happened Explanation Correct Answer C:Content retention and action-level audit records have separate event coverage, retention and search permissions. Incorrect Answers A:Content preservation does not create a full audit history of every activity. B:eDiscovery does not fabricate Sentinel files. D:Recoverable retained content can coexist with deletion of an active copy.
Question 612 A confidential SharePoint document was deleted at 09:15. The SOC needs to attribute the deletion, not retrieve its body. Which record provides the appropriate action-level evidence? An eDiscovery search finds only a retained copy of the document content A sensitivity-label publication report lists the label policy An endpoint inventory report lists devices owned by the custodian A Purview Audit event identifies the file operation, acting user, timestamp and resource Explanation Correct Answer D:Audit records track eligible actions on content, including attribution and timing when the relevant audit event exists. Incorrect Answers A:Stored content can establish what the document contained but not necessarily who deleted it and when. B:Policy publication is not evidence of a particular deletion event. C:Device inventory does not attribute a SharePoint file operation.
Question 613 A financial services SOC needs to correlate multiple suspicious file downloads by the same user over time. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Examine applicable Exchange mailbox audit operations and timestamps Filter relevant audit activity by principal, event and time window Evaluate Audit log retention separately from content preservation policies Correlate Graph activity client identity with Entra application and sign-in data Explanation Correct Answer B:Audit records support activity reconstruction across applicable workloads. Incorrect Answers A:Mailbox rule changes can be investigated through audit activity. C:Audit log duration does not preserve the underlying mailbox item. D:Principal context establishes which app made the request.
Question 614 The regional SOC SOC needs to correlate multiple suspicious file downloads by the same user over time, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Audit log duration does not preserve the underlying mailbox item. Audit records support activity reconstruction across applicable workloads. Audit searches reconstruct logged operations rather than document content itself. Graph activity logs record API activity distinct from ordinary mailbox content. Explanation Correct Answer B:Audit records support activity reconstruction across applicable workloads. Incorrect Answers A:Avoiding confusing retention of audit records with retention of messages does not correlate multiple suspicious file downloads by the same user over time. C:Identifying who deleted a sensitive SharePoint document and when does not correlate multiple suspicious file downloads by the same user over time. D:Investigating unexpected Microsoft Graph API calls made by an application does not correlate multiple suspicious file downloads by the same user over time.
Question 615 Two file download audit events share a display name, and an analyst assumes one user exfiltrated all files although the actor identifiers differ. Which explanation best accounts for the specific failure? Authentication records do not show the Exchange mailbox rule-creation operation The audit query is not scoped to a consistent principal and relevant download operation/time window Audit event retention is separate from retaining the underlying mailbox content A saved search is not a preservation hold and does not prevent eligible content from aging out or being removed Explanation Correct Answer B:The audit query is not scoped to a consistent principal and relevant download operation/time window. Incorrect Answers A:Authentication records do not show the Exchange mailbox rule-creation operation; the audit query is not scoped to a consistent principal and relevant download operation/time window. C:Audit event retention is separate from retaining the underlying mailbox content; the audit query is not scoped to a consistent principal and relevant download operation/time window. D:A saved search is not a preservation hold and does not prevent eligible content from aging out or being removed; the audit query is not scoped to a consistent principal and relevant download operation/time window.
Question 616 During a controlled investigation, a test user downloads multiple protected files over a defined hour. Which observation most directly verifies the intended technical behavior? An applicable mailbox audit event records the rule operation, actor and time The Audit search results return the same actor's matching download operations with timestamps and target files Audit still records the deletion event; content remains discoverable only when relevant retention or hold applies Case hold status and preserved source content allow the deleted responsive material to remain discoverable Explanation Correct Answer B:The Audit search results return the same actor's matching download operations with timestamps and target files. Incorrect Answers A:An applicable mailbox audit event records the rule operation, actor and time; the Audit search results return the same actor's matching download operations with timestamps and target files. C:Audit still records the deletion event; content remains discoverable only when relevant retention or hold applies; the Audit search results return the same actor's matching download operations with timestamps and target files. D:Case hold status and preserved source content allow the deleted responsive material to remain discoverable; the Audit search results return the same actor's matching download operations with timestamps and target files.
Question 617 A regional bank needs to verify whether a specific mailbox rule was created during account compromise. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Evaluate Audit log retention separately from content preservation policies Filter relevant audit activity by principal, event and time window Create a scoped Content search in Microsoft Purview eDiscovery Examine applicable Exchange mailbox audit operations and timestamps Explanation Correct Answer D:Mailbox rule changes can be investigated through audit activity. Incorrect Answers A:Audit log duration does not preserve the underlying mailbox item. B:Audit records support activity reconstruction across applicable workloads. C:Content search finds eligible stored items rather than merely listing activity events.
Question 618 The health network SOC needs to verify whether a specific mailbox rule was created during account compromise, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Audit log duration does not preserve the underlying mailbox item. Graph activity logs record API activity distinct from ordinary mailbox content. Mailbox rule changes can be investigated through audit activity. Audit searches reconstruct logged operations rather than document content itself. Explanation Correct Answer C:Mailbox rule changes can be investigated through audit activity. Incorrect Answers A:Avoiding confusing retention of audit records with retention of messages does not verify whether a specific mailbox rule was created during account compromise. B:Investigating unexpected Microsoft Graph API calls made by an application does not verify whether a specific mailbox rule was created during account compromise. D:Identifying who deleted a sensitive SharePoint document and when does not verify whether a specific mailbox rule was created during account compromise.
Question 619 A mailbox's Inbox rules changed during an attack but the team searches only successful login audit records. Which explanation best accounts for the specific failure? The audit query is not scoped to a consistent principal and relevant download operation/time window Audit event retention is separate from retaining the underlying mailbox content The search scope and query filters are broader than the specific investigation requires Authentication records do not show the Exchange mailbox rule-creation operation Explanation Correct Answer D:Authentication records do not show the Exchange mailbox rule-creation operation. Incorrect Answers A:The audit query is not scoped to a consistent principal and relevant download operation/time window; authentication records do not show the Exchange mailbox rule-creation operation. B:Audit event retention is separate from retaining the underlying mailbox content; authentication records do not show the Exchange mailbox rule-creation operation. C:The search scope and query filters are broader than the specific investigation requires; authentication records do not show the Exchange mailbox rule-creation operation.
Question 620 During a controlled investigation, a compromised mailbox has an unauthorized forwarding rule created. Which observation most directly verifies the intended technical behavior? The Audit search results return the same actor's matching download operations with timestamps and target files Audit still records the deletion event; content remains discoverable only when relevant retention or hold applies An applicable mailbox audit event records the rule operation, actor and time The refined query returns messages from authorized custodians in the intended date range instead of the full tenant Explanation Correct Answer C:An applicable mailbox audit event records the rule operation, actor and time. Incorrect Answers A:The Audit search results return the same actor's matching download operations with timestamps and target files; an applicable mailbox audit event records the rule operation, actor and time. B:Audit still records the deletion event; content remains discoverable only when relevant retention or hold applies; an applicable mailbox audit event records the rule operation, actor and time. D:The refined query returns messages from authorized custodians in the intended date range instead of the full tenant; an applicable mailbox audit event records the rule operation, actor and time.
