Question 620 During a controlled investigation, a compromised mailbox has an unauthorized forwarding rule created. Which observation most directly verifies the intended technical behavior? The Audit search results return the same actor's matching download operations with timestamps and target files Audit still records the deletion event; content remains discoverable only when relevant retention or hold applies An applicable mailbox audit event records the rule operation, actor and time The refined query returns messages from authorized custodians in the intended date range instead of the full tenant Explanation Correct Answer C:An applicable mailbox audit event records the rule operation, actor and time. Incorrect Answers A:The Audit search results return the same actor's matching download operations with timestamps and target files; an applicable mailbox audit event records the rule operation, actor and time. B:Audit still records the deletion event; content remains discoverable only when relevant retention or hold applies; an applicable mailbox audit event records the rule operation, actor and time. D:The refined query returns messages from authorized custodians in the intended date range instead of the full tenant; an applicable mailbox audit event records the rule operation, actor and time.
Question 621 A logistics company needs to avoid confusing retention of audit records with retention of messages. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Evaluate Audit log retention separately from content preservation policies Search the applicable Microsoft Purview Audit events using the resource and activity criteria Create a scoped Content search in Microsoft Purview eDiscovery Examine applicable Exchange mailbox audit operations and timestamps Explanation Correct Answer A:Audit log duration does not preserve the underlying mailbox item. Incorrect Answers B:Audit searches reconstruct logged operations rather than document content itself. C:Content search finds eligible stored items rather than merely listing activity events. D:Mailbox rule changes can be investigated through audit activity.
Question 622 The public university SOC needs to avoid confusing retention of audit records with retention of messages, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Principal context establishes which app made the request. Audit records support activity reconstruction across applicable workloads. Audit log duration does not preserve the underlying mailbox item. Audit searches reconstruct logged operations rather than document content itself. Explanation Correct Answer C:Audit log duration does not preserve the underlying mailbox item. Incorrect Answers A:Identifying which service principal called a sensitive Graph endpoint does not avoid confusing retention of audit records with retention of messages. B:Correlating multiple suspicious file downloads by the same user over time does not avoid confusing retention of audit records with retention of messages. D:Identifying who deleted a sensitive SharePoint document and when does not avoid confusing retention of audit records with retention of messages.
Question 623 A SOC raises Audit record retention and claims deleted user email bodies will now be preserved for discovery. Which explanation best accounts for the specific failure? Audit event retention is separate from retaining the underlying mailbox content The audit query is not scoped to a consistent principal and relevant download operation/time window Authentication records do not show the Exchange mailbox rule-creation operation Audit records the activity; content recovery requires eDiscovery against preserved eligible content Explanation Correct Answer A:Audit event retention is separate from retaining the underlying mailbox content. Incorrect Answers B:The audit query is not scoped to a consistent principal and relevant download operation/time window; audit event retention is separate from retaining the underlying mailbox content. C:Authentication records do not show the Exchange mailbox rule-creation operation; audit event retention is separate from retaining the underlying mailbox content. D:Audit records the activity; content recovery requires eDiscovery against preserved eligible content; audit event retention is separate from retaining the underlying mailbox content.
Question 624 During a controlled investigation, a user's deletion of a message occurs while audit logging and content preservation policies differ. Which observation most directly verifies the intended technical behavior? The Audit search results return the same actor's matching download operations with timestamps and target files An applicable mailbox audit event records the rule operation, actor and time Audit provides the deletion action while eDiscovery retrieves the actual preserved item body Audit still records the deletion event; content remains discoverable only when relevant retention or hold applies Explanation Correct Answer D:Audit still records the deletion event; content remains discoverable only when relevant retention or hold applies. Incorrect Answers A:The Audit search results return the same actor's matching download operations with timestamps and target files; audit still records the deletion event; content remains discoverable only when relevant retention or hold applies. B:An applicable mailbox audit event records the rule operation, actor and time; audit still records the deletion event; content remains discoverable only when relevant retention or hold applies. C:Audit provides the deletion action while eDiscovery retrieves the actual preserved item body; audit still records the deletion event; content remains discoverable only when relevant retention or hold applies.
Question 625 A health network needs to find relevant retained communications for an authorized insider investigation. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Use scoped sources and search query filters in eDiscovery Create a scoped Content search in Microsoft Purview eDiscovery Evaluate Audit log retention separately from content preservation policies Use eDiscovery for eligible content and Audit for the deletion activity Explanation Correct Answer B:Content search finds eligible stored items rather than merely listing activity events. Incorrect Answers A:Appropriate scope reduces unrelated private data and improves review. C:Audit log duration does not preserve the underlying mailbox item. D:Content and activity evidence answer different investigative questions.
Question 626 The manufacturer SOC needs to find relevant retained communications for an authorized insider investigation, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Appropriate scope reduces unrelated private data and improves review. Content search finds eligible stored items rather than merely listing activity events. Content and activity evidence answer different investigative questions. API request patterns help establish the extent of application access. Explanation Correct Answer B:Content search finds eligible stored items rather than merely listing activity events. Incorrect Answers A:Narrowing a large evidence search to relevant custodians and date ranges does not find relevant retained communications for an authorized insider investigation. C:Distinguishing a message's actual body from the event recording its deletion does not find relevant retained communications for an authorized insider investigation. D:Detecting high-volume calls to a restricted Graph API following suspicious OAuth consent does not find relevant retained communications for an authorized insider investigation.
Question 627 An eDiscovery search returns no messages for a custodian even though the custodian has relevant mailbox content. The search excludes that mailbox and the relevant date interval. What should be corrected? Create a Defender custom endpoint detection rule Enable a Microsoft Sentinel ASR control on every device Change an Azure VM diagnostic category for subscription logs Add the authorized mailbox source and a date range that includes the responsive messages Explanation Correct Answer D:eDiscovery search results are bounded by the explicitly selected content sources and query filters. Incorrect Answers A:Endpoint threat detection cannot enlarge the eDiscovery mailbox scope. B:ASR endpoint configuration does not search mailbox content. C:Azure VM diagnostics are unrelated to Purview content search criteria.
Question 628 An authorized legal investigation must preserve the actual email text and attachments relevant to a user. Which observation confirms eDiscovery found content rather than just an audit event? Purview Audit displays a record that the user opened Outlook A scoped eDiscovery search returns eligible responsive message items and their source/custodian context A Graph activity log shows an API request for message metadata A DLP alert reports a policy match but no preserved email item Explanation Correct Answer B:eDiscovery searches identify retained mailbox/content items that can be reviewed under authorized legal workflows. Incorrect Answers A:An Outlook access event is action metadata rather than the message body and attachments. C:An API request does not itself supply the responsive preserved content. D:A DLP alert signals a policy event, not a retained responsive mailbox item.
Question 629 A public university needs to preserve responsive mailbox items from deletion during a legal hold request. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Create a scoped Content search in Microsoft Purview eDiscovery Review Graph request telemetry and returned operation context when available Use scoped sources and search query filters in eDiscovery Apply an authorized eDiscovery hold at the supported source scope Explanation Correct Answer D:Holds preserve content rather than serving as a real-time detection rule. Incorrect Answers A:Content search finds eligible stored items rather than merely listing activity events. B:Authentication evidence and API resource activity are distinct. C:Appropriate scope reduces unrelated private data and improves review.
Question 630 The retailer SOC needs to preserve responsive mailbox items from deletion during a legal hold request, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Content search finds eligible stored items rather than merely listing activity events. Content and activity evidence answer different investigative questions. Audit searches reconstruct logged operations rather than document content itself. Holds preserve content rather than serving as a real-time detection rule. Explanation Correct Answer D:Holds preserve content rather than serving as a real-time detection rule. Incorrect Answers A:Finding relevant retained communications for an authorized insider investigation does not preserve responsive mailbox items from deletion during a legal hold request. B:Distinguishing a message's actual body from the event recording its deletion does not preserve responsive mailbox items from deletion during a legal hold request. C:Identifying who deleted a sensitive SharePoint document and when does not preserve responsive mailbox items from deletion during a legal hold request.
