MS-102 Manage compliance by using Microsoft Purview Practice Question
You need to monitor which users have accessed a specific document stored in SharePoint Online over the last 90 days. What should you use?
⚠ Common exam trap
MS-102 often tests the confusion between content discovery tools (Content search, eDiscovery) that find *what* is in a file versus activity auditing tools (Audit log search) that reveal *who did what*—candidates incorrectly pick Content search because it also lives in Microsoft Purview and can target a specific document.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Audit log search in Microsoft Purview.
Audit log search in Microsoft Purview is the correct tool because it queries the unified audit log, which records user activities such as file access, download, and sharing events across SharePoint Online and OneDrive for Business. The 'Accessed file' and 'FileAccessed' operations are captured with the user identity, timestamp, and item path, allowing you to filter by date range (up to 90 days by default, extendable to 1 year with the right license) and by the specific document URL. This directly answers the requirement to see *who* accessed a *specific document* over a defined period.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Loss Prevention reports.
Why it's wrong here
DLP reports summarise policy matches and incidents, not individual document access events. Audit log search in Microsoft Purview records who viewed or downloaded a file. DLP reports suit monitoring policy violations and oversharing, not access auditing.
- ✗
eDiscovery (Premium) case.
Why it's wrong here
eDiscovery (Premium) cases support legal hold, custodian management and review sets for investigations, not routine access monitoring. The audit log search surfaces who accessed a document. eDiscovery suits litigation or internal investigation workflows requiring preserved evidence.
- ✗
Content search in Microsoft Purview.
Why it's wrong here
Content search locates items matching keywords or properties across workloads; it returns matching content, not who accessed it. Audit log search records document access events. Content search suits finding where sensitive data resides, not tracking user access history.
- ✓
Audit log search in Microsoft Purview.
Why this is correct
Audit log search in Microsoft Purview retains SharePoint Online file-access events for 90 days by default, letting you filter on the specific document and retrieve the users who opened it. This directly satisfies the 90-day historical access requirement, which standard SharePoint site analytics cannot provide.
Go deeper
Related to this question
Learn chapter
Entra ID Entitlement Management and Access Packages
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Audit log
An audit log is a chronological record of security-relevant events and user activities within a system, used for monitoring, compliance, and forensic analysis.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.