SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Exhibit
{
"Query": "Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) -Operations 'FileDeleted','FileModified','FileUploaded' -UserIds 'user@contoso.com'"
}Refer to the exhibit. An administrator runs the PowerShell command shown. What is the purpose of this command?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Search audit logs for file activities performed by a specific user
The command searches the unified audit log for file-related operations by a specific user in the last 90 days. Option C is correct. It does not delete files, modify permissions, or block the user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete all files modified by a user in the last 90 days
Why it's wrong here
The command only searches, it does not delete.
- ✗
Modify permissions on files uploaded by a user
Why it's wrong here
No permission modification is performed.
- ✓
Search audit logs for file activities performed by a specific user
Why this is correct
The command specifies operations and user IDs to search.
- ✗
Block a user from uploading files
Why it's wrong here
The command does not block any user.
Go deeper
Related to this question
Learn chapter
eDiscovery and Audit
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An administrator runs this PowerShell command. What is the purpose of this command?
medium- A.To set a retention policy for the HR site.
- B.To apply a retention label to all files in the HR site.
- C.To delete all files in the HR site that were accessed in the last 90 days.
- ✓ D.To retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.
Why D: The PowerShell cmdlet `Search-UnifiedAuditLog` is used to retrieve audit records from the Microsoft 365 unified audit log. The `-StartDate` and `-EndDate` parameters define the time range (last 90 days), and the `-RecordType` parameter filters for SharePoint audit events. The `-Operations` parameter with `FileAccessed` and `FileModified` specifies that only file access and modification events should be returned, making this command's purpose to retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.