MS-102 Manage compliance by using Microsoft Purview Practice Question
Your company is implementing Microsoft Purview Audit (Standard). You need to search for activities performed by a specific user in Exchange Online. Which log should you query?
⚠ Common exam trap
MS-102 often tests the misconception that mailbox audit logs and the Unified audit log are separate query targets in Purview Audit (Standard) — in fact, Exchange Online activities are surfaced through the Unified audit log, and 'mailbox audit logs only' is a distractor that misrepresents the architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unified audit log.
Microsoft Purview Audit (Standard) stores all audit events — including Exchange Online user activities — in the Unified audit log, which is queried via the Microsoft Purview compliance portal or the Search-UnifiedAuditLog PowerShell cmdlet. To find activities performed by a specific user in Exchange Online, you search the Unified audit log and filter by the user's UPN and the relevant Exchange workloads/activities. This is the single centralized log for Purview Audit (Standard) across Microsoft 365 services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Unified audit log.
Why this is correct
Purview Audit (Standard) writes Exchange Online activities to the unified audit log, which is the only searchable repository for user-level events in Microsoft 365. Querying it satisfies the requirement to find activities performed by a specific user, since mailbox audit records surface there rather than in transport or IIS logs.
- ✗
DLP incident reports.
Why it's wrong here
DLP incident reports show policy matches and alerts for sensitive data, not a user's Exchange Online activity trail. They are tempting because they are generated from Exchange Online traffic, but Purview Audit (Standard) queries the unified audit log, which records the actual user operations required here.
- ✗
Microsoft Entra ID audit logs.
Why it's wrong here
Microsoft Entra ID audit logs record directory and sign-in events such as user and group changes, not Exchange Online mailbox activity. They are tempting because they are audit logs tied to the same user identity, but Purview Audit (Standard) searches the unified audit log for Exchange Online activities.
- ✗
Mailbox audit logs only.
Why it's wrong here
Exchange Online user activity is recorded in the unified audit log, which Microsoft Purview Audit (Standard) searches; mailbox audit logs alone omit non-mailbox events and are a legacy per-mailbox view. Querying them is tempting because they do contain mailbox actions, but they are not the Purview Audit search surface.
Go deeper
Related to this question
Learn chapter
Exchange Calendar Permissions and Resource Mailboxes
Key term
Audit log
An audit log is a chronological record of security-relevant events and user activities within a system, used for monitoring, compliance, and forensic analysis.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.