MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
Your company uses Microsoft 365 E5 and has enabled Microsoft Purview Audit (Premium). The security team needs to investigate a potential data breach by searching for all activities related to a specific user in the last 90 days. Which tool should they use?
⚠ Common exam trap
The trap is that candidates may assume eDiscovery (Premium) is the right choice for a breach investigation because it sounds comprehensive, but eDiscovery does not search audit logs for user actions. The audit log search is the tool specifically built for reviewing user and admin activities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Audit (Premium) log search
Microsoft Purview Audit (Premium) log search is the appropriate tool to search the unified audit log for activities performed by a specific user across Microsoft 365 services. Since the security team needs to find all user-related activities in the last 90 days, the audit log search (Option C) directly meets this requirement. eDiscovery (Premium) is designed for finding content (e.g., emails, documents) and for legal holds, not for searching user activity logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Compliance Manager
Why it's wrong here
Microsoft Purview Compliance Manager is a risk-assessment dashboard that calculates compliance scores and suggests improvement actions, but it does not collect or index user activity events. It is designed to manage regulatory obligations, not to reconstruct a user's actions during a security incident, so it cannot serve as an investigation tool.
- ✗
Microsoft Purview Content Search
Why it's wrong here
Content Search indexes static mailbox and site content for eDiscovery, not the real-time, user-centric audit log of every action taken in Exchange, SharePoint, and Entra ID that Purview Audit (Premium) captures. It is tempting because it can locate emails or documents containing keywords, which seems relevant to a breach investigation, but it cannot produce the chronological activity trail—such as sign-ins, permission changes, or file accesses—that the security team requires. Content Search would be correct if the task were to find and export specific data items matching a query, rather than reconstructing a user’s sequence of operations.
- ✓
Microsoft Purview Audit (Premium) log search
Why this is correct
Purview Audit (Premium) log search captures user and admin sign-in, file access, and configuration change events, offering a rich activity trail, but it is limited to audit log events and cannot hold or deep-search across all content locations like mailboxes and sites. For a comprehensive investigation that requires preserving evidence and analyzing responsive documents, eDiscovery Premium is the appropriate tool.
- ✗
Microsoft Purview eDiscovery (Premium)
Why it's wrong here
Microsoft Purview eDiscovery (Premium) provides a full investigation pipeline—searching across Exchange Online, SharePoint, OneDrive, and Teams, then preserving, reviewing, analyzing, and exporting the results. It supports legal holds and advanced analytics, making it the correct choice for a thorough, user-centric investigation that requires a defensible collection of evidence.
Go deeper
Related to this question
Learn chapter
Microsoft Purview Information Protection
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
eDiscovery
eDiscovery is the process of identifying, collecting, and producing electronic information for legal cases or investigations.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.