SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security analyst needs to query Microsoft 365 audit logs to find all activities where a user deleted a file from SharePoint Online in the last 24 hours. Which tool should they use?
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Sentinel (a SIEM) with a simple audit log search tool, but Sentinel is designed for advanced threat detection and correlation, not for direct, ad-hoc queries of the unified audit log without additional setup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview compliance portal audit search
Microsoft Purview compliance portal audit search is the correct tool because it provides a dedicated, searchable interface for querying the Microsoft 365 unified audit log. This log records all user and admin activities, including file deletions from SharePoint Online, and supports time-based filters (e.g., last 24 hours) to retrieve specific events. It is purpose-built for compliance and security investigations without requiring additional licensing or complex scripting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution that aggregates security data from various sources. While it can ingest Microsoft 365 audit logs into an Azure Log Analytics workspace for advanced analysis and correlation, it is not the native, direct interface for performing ad-hoc audit log searches within Microsoft 365 itself. Querying logs in Sentinel requires prior ingestion setup and Kusto Query Language (KQL) knowledge, making it less direct for initial investigative queries than a dedicated portal.
- ✓
Microsoft Purview compliance portal audit search
Why this is correct
The Microsoft Purview compliance portal audit search provides the native, centralized, and most user-friendly interface for security analysts to query Microsoft 365 audit logs. This dedicated portal allows for comprehensive searching across various services like Exchange Online, SharePoint Online, Teams, and Azure AD, offering extensive filtering capabilities by date, user, activity, and workload. It is specifically designed for investigative purposes, enabling efficient identification of specific user or administrator actions without requiring complex scripting.
- ✗
Microsoft Graph PowerShell
Why it's wrong here
While the Microsoft Graph API, accessible via Microsoft Graph PowerShell, can programmatically retrieve certain audit-related data, it is not the most straightforward or comprehensive method for a security analyst to perform interactive audit log searches across all Microsoft 365 services. Utilizing PowerShell for this purpose typically involves scripting against specific API endpoints, which is less efficient for ad-hoc investigations and lacks the intuitive filtering and visualization capabilities offered by a dedicated graphical user interface.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps (MDCA) functions as a Cloud Access Security Broker (CASB), primarily focused on discovering cloud applications, identifying shadow IT, enforcing data protection policies, and detecting anomalous behavior within cloud environments. Although MDCA leverages activity logs for its threat protection and governance features, its core purpose is not to serve as a direct, comprehensive audit log search engine for all Microsoft 365 services. It provides insights into app usage and risk, rather than a granular, service-wide audit trail search capability.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.