SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Exhibit
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) -Operations FileAccessed,FileModified -RecordType SharePoint -ObjectId "https://contoso.sharepoint.com/sites/hr"
Refer to the exhibit. An administrator runs this PowerShell command. What is the purpose of this command?
⚠ Common exam trap
Many candidates confuse the `Search-UnifiedAuditLog` cmdlet with cmdlets that manage retention or deletion, because the question mentions 'files' and '90 days' which can mislead test-takers into thinking it applies a policy or deletes data, when in fact it only retrieves audit records.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.
The PowerShell cmdlet `Search-UnifiedAuditLog` is used to retrieve audit records from the Microsoft 365 unified audit log. The `-StartDate` and `-EndDate` parameters define the time range (last 90 days), and the `-RecordType` parameter filters for SharePoint audit events. The `-Operations` parameter with `FileAccessed` and `FileModified` specifies that only file access and modification events should be returned, making this command's purpose to retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To set a retention policy for the HR site.
Why it's wrong here
This command is designed exclusively for searching and retrieving audit records from the Microsoft Purview Unified Audit Log. It does not possess any functionality to configure or modify compliance features such as retention policies. Setting retention policies involves using specific cmdlets like `New-RetentionCompliancePolicy` or configuring them directly within the Microsoft Purview compliance portal, which are distinct administrative actions from auditing past events.
- ✗
To apply a retention label to all files in the HR site.
Why it's wrong here
The `Search-UnifiedAuditLog` cmdlet is a read-only operation focused on querying historical activity data. It is not capable of performing active compliance actions like applying retention labels to files. Applying retention labels is a content modification action, typically performed manually by users, through auto-labeling policies, or via specific PowerShell cmdlets designed for compliance labeling, none of which are invoked by this audit search command.
- ✗
To delete all files in the HR site that were accessed in the last 90 days.
Why it's wrong here
This PowerShell command is solely for querying the unified audit log to report on past events; it does not execute any destructive actions on content. The `Search-UnifiedAuditLog` cmdlet retrieves metadata about operations, such as when files were accessed, but it does not have the capability to delete files or modify content within SharePoint sites. Deleting content requires specific SharePoint administration commands or user actions, which are entirely separate from audit log retrieval.
- ✓
To retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.
Why this is correct
The `Search-UnifiedAuditLog` cmdlet, combined with the `-Operations FileAccessed, FileModified` parameters, precisely targets the auditing of these specific file activities. The `-SiteIds` parameter scopes the search to the designated HR SharePoint site, and the `-StartDate` and `-EndDate` parameters accurately define the 90-day look-back period. This command effectively retrieves a comprehensive list of audit records detailing when files were accessed or modified within that specific site and timeframe.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Audit log
An audit log is a chronological record of security-relevant events and user activities within a system, used for monitoring, compliance, and forensic analysis.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.