The correct action is to enable Audit (Premium) licensing for the user and then search the audit log. This is necessary because Microsoft Purview Audit (Standard) only captures and retains basic events like site access for 90 days, but it does not log granular file-level operations such as item access, modification, or deletion. To investigate the exact actions performed on sensitive files in SharePoint Online, you must upgrade the user to Audit (Premium), which provides detailed record types like FileAccessed and FileModified, along with extended 180-day retention. On the MS-102 exam, this scenario tests your understanding of the functional gap between Standard and Premium auditing, often appearing as a trap where candidates mistakenly choose the Search-UnifiedAuditLog cmdlet, forgetting that Standard lacks the necessary event detail. A helpful memory tip: Standard logs “who went where,” but Premium logs “who did what” on each file.
MS-102 Manage compliance by using Microsoft Purview Practice Question
This MS-102 practice question tests your understanding of manage compliance by using microsoft purview. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your organization uses Microsoft Purview Audit (Standard) for auditing user activity. You receive an alert that a user accessed sensitive files in SharePoint Online. You need to investigate the exact actions performed by the user. Which action should you take?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Audit (Premium) licensing for the user and then search the audit log.
Option C is correct because Audit (Standard) only retains audit logs for 90 days and does not include detailed file-level operations like item access. You would need to upgrade to Audit (Premium) to get those details. Option A is incorrect because the Search-UnifiedAuditLog cmdlet works with both editions but may not show item-level details in Standard. Option B is incorrect because the Compliance Manager does not store audit logs. Option D is incorrect because there is no 'Audit Log Search' tab in Purview; the correct tool is the Audit solution.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Run the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell.
Why it's wrong here
Standard audit may not include item-level operations.
✗
Navigate to the Microsoft Purview portal and use the Audit Log Search tab.
Why it's wrong here
The Audit solution is accessed via the Purview portal, but Standard audit may lack details.
✓
Enable Audit (Premium) licensing for the user and then search the audit log.
Why this is correct
Audit (Premium) provides detailed file-level audit records.
Related concept
Read the scenario before looking for a memorised answer.
✗
Access Microsoft Purview Compliance Manager and review the user's activity.
Why it's wrong here
Compliance Manager does not store audit logs.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.
Detailed technical explanation
How to think about this question
This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
Use explanations to understand the rule behind the answer.
TExam Day Tips
→Underline the problem statement mentally.
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Identify which MS-102 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
Manage compliance by using Microsoft Purview — This question tests Manage compliance by using Microsoft Purview — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Enable Audit (Premium) licensing for the user and then search the audit log. — Option C is correct because Audit (Standard) only retains audit logs for 90 days and does not include detailed file-level operations like item access. You would need to upgrade to Audit (Premium) to get those details. Option A is incorrect because the Search-UnifiedAuditLog cmdlet works with both editions but may not show item-level details in Standard. Option B is incorrect because the Compliance Manager does not store audit logs. Option D is incorrect because there is no 'Audit Log Search' tab in Purview; the correct tool is the Audit solution.
What should I do if I get this MS-102 question wrong?
Identify which MS-102 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company is implementing Microsoft Purview Audit (Standard). You need to search for activities performed by a specific user in Exchange Online. Which log should you query?
easy
✓ A.Unified audit log.
B.DLP incident reports.
C.Azure AD audit logs.
D.Mailbox audit logs only.
Why A: Audit (Standard) records all user and admin activities in Exchange Online. The unified audit log is the correct source. Option A is incorrect because Azure AD audit logs are for identity activities. Option C is incorrect because DLP reports are for DLP matches. Option D is incorrect because Mailbox audit logs are a subset but unified audit log is the comprehensive source.
Variation 2. Your company, Wingtip Toys, uses Microsoft Purview Audit (Standard) to track user activity. The compliance officer needs to investigate a potential data leak involving a user who may have accessed sensitive files in SharePoint Online. You need to search the audit log for file access events for that specific user over the past 30 days. The audit log contains millions of records. What is the most efficient way to retrieve the required audit records?
medium
✓ A.Use the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell with the -UserIds and -StartDate/-EndDate parameters.
B.Use the Microsoft Purview compliance portal audit log search page to filter by user and date range.
C.Export the entire audit log to a CSV file using the New-UnifiedAuditLog cmdlet, then filter in Excel.
D.Use the Security & Compliance Center PowerShell module with the Search-MailboxAuditLog cmdlet.
Why A: Option A is correct because using Search-UnifiedAuditLog with the UserIds and StartDate/EndDate parameters efficiently filters for the specific user and time range. Option B is wrong because exporting all records is inefficient. Option C is wrong because the Purview compliance portal's audit log search allows filtering but is less efficient than PowerShell for large volumes. Option D is wrong because Security & Compliance Center PowerShell is deprecated in favor of Exchange Online PowerShell.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.