SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
An organization uses Microsoft Purview Audit to meet compliance requirements. Which TWO types of audit logs can be accessed?
⚠ Common exam trap
It's easy for candidates to confuse Azure AD audit logs (which are part of Azure Monitor) with the Microsoft 365 unified audit log (which is part of Purview), leading them to select Option B as a correct answer when it is actually a separate service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Purview advanced audit logs
Microsoft Purview Audit provides two primary audit log access methods: the Microsoft 365 unified audit log, which aggregates audit records from various Microsoft 365 services, and Purview advanced audit logs, which offer extended retention (up to 10 years) and high-value events like investigation of privileged access. These two options directly correspond to the core audit capabilities within Purview for compliance requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Windows Security event logs
Why it's wrong here
Windows Security event logs originate from individual Windows operating systems, typically on-premises servers or IaaS virtual machines, and are managed by the local Event Log service. Microsoft Purview Audit, conversely, is a cloud-based service designed to capture and retain audit activities across Microsoft 365 services and other integrated data sources. These logs are distinct and not directly ingested or managed by Purview for compliance purposes.
- ✗
Azure Active Directory audit logs
Why it's wrong here
Azure Active Directory audit logs record critical security and operational events related to user authentication, directory changes, and application usage within Azure AD. While these logs are crucial for identity and access management, they are primarily managed and accessed via the Azure portal, Microsoft Graph, or Azure Monitor. Although some AAD activities are surfaced in the Microsoft 365 unified audit log, the full scope of Azure AD audit logs is a separate, dedicated logging service.
- ✓
Purview advanced audit logs
Why this is correct
Purview advanced audit logs represent an enhanced set of auditing capabilities available with specific Microsoft 365 E5 compliance licenses. These logs provide higher fidelity events, such as detailed mailbox item access or eDiscovery search activities, and offer extended audit log retention periods up to 10 years. They are integral to advanced forensic investigations and meeting stringent regulatory compliance requirements, building upon the foundational unified audit log.
- ✓
Microsoft 365 unified audit log
Why this is correct
The Microsoft 365 unified audit log is the foundational service that aggregates audit records from numerous Microsoft 365 services, including Exchange Online, SharePoint Online, Teams, and Power BI, into a centralized, searchable repository. This log provides a comprehensive and consistent view of user and administrator activities across the entire M365 ecosystem. It is essential for basic compliance, security investigations, and operational monitoring within an organization's Microsoft cloud environment.
- ✗
Azure SQL Database audit logs
Why it's wrong here
Azure SQL Database audit logs are specifically generated by Azure SQL Database instances to track database events such as logins, queries, and schema modifications. These logs are configured and managed directly within the Azure SQL Database service and are typically stored in Azure Storage accounts, Log Analytics workspaces, or Azure Event Hubs. While Microsoft Purview can catalog and govern data within Azure SQL, its core audit solution does not directly ingest or manage these specific database audit logs.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Audit log
An audit log is a chronological record of security-relevant events and user activities within a system, used for monitoring, compliance, and forensic analysis.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.