MS-102 Unified audit log Practice Question
Exhibit
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -RecordType SharePointFileOperation -Operations FileDownloaded -UserIds user@contoso.com | Format-Table CreationTime, Operation, ItemName
Refer to the exhibit. You run the PowerShell command shown. The output shows no results. The user confirms they downloaded files from SharePoint last week. What is the most likely cause?
⚠ Common exam trap
The trap is assuming that an empty audit log search means no activity occurred, when it often means audit logging was never enabled or the events have not yet been ingested.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Audit logging is not enabled for the user.
The PowerShell command shown is likely Search-UnifiedAuditLog, which queries the unified audit log. If the output is empty despite the user having downloaded files from SharePoint, the most likely cause is that audit logging (specifically, mailbox or SharePoint audit logging) is not enabled for that user or workload. Without audit logging turned on, no events are recorded, so the search returns nothing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The UserIds parameter is misspelled.
Why it's wrong here
The UserIds parameter is a valid, correctly spelled parameter for Search-UnifiedAuditLog and accepts one or more user principal names. If it were misspelled, the cmdlet would fail immediately with a parameter binding error rather than returning an empty result set. Since the command executed and returned no events, spelling is not the cause.
- ✗
The RecordType parameter is incorrect.
Why it's wrong here
RecordType correctly uses SharePointFileOperation, a valid Microsoft.Exchange.Management.Search.AuditLog.RecordType enum value that filters for SharePoint and OneDrive file activities. An incorrect or unsupported RecordType value would trigger an argument validation exception before the query runs. Therefore this parameter is correctly specified and cannot explain the absence of audit records.
- ✓
Audit logging is not enabled for the user.
Why this is correct
The unified audit log contains no eligible events for this search if audit logging is not enabled for the user, even when every command parameter is correct. In Microsoft 365, user activities such as FileDownloaded are published to the audit log only when auditing is enabled at the tenant level and the user has the required license. Because the command itself is valid, the empty output indicates that audit events were never generated for this user, not that the syntax is flawed.
- ✗
The Operations parameter is incorrect.
Why it's wrong here
FileDownloaded is a valid Operations value within the SharePointFileOperation record type, and Search-UnifiedAuditLog accepts it without error. If the operation name were invalid, the cmdlet would reject the value with an argument exception instead of silently returning no results. The empty output therefore reflects missing underlying audit data rather than a bad operation filter.
Go deeper
Related to this question
Learn chapter
SharePoint Online Administration
Key term
Mailbox
A mailbox is a storage location on a mail server where incoming and outgoing email messages are kept for a user or group.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.