SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Exhibit
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -Operations FileDownloaded,FileAccessed | Where-Object {$_.UserId -eq "user@contoso.com"} | Format-Table CreationDate,Operation,ItemNameRefer to the exhibit. You run the PowerShell command shown to investigate a potential data exfiltration incident. The output is empty. Which is the most likely reason?
⚠ Common exam trap
Common mistake: Candidates often assume that an empty output from Search-UnifiedAuditLog means no activity occurred. However, the most frequent reason is that unified audit logging is not enabled, which prevents any audit records from being captured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Audit logging is not enabled for the tenant
The Search-UnifiedAuditLog cmdlet retrieves entries from the unified audit log. If the output is empty, the most likely cause is that unified audit logging is not enabled for the tenant. In Microsoft 365, unified audit logging must be turned on in the compliance portal or via PowerShell (Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true). Without this, no audit records are generated, so the cmdlet returns no results regardless of user activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user does not have a mailbox
Why it's wrong here
Unified audit logging in Microsoft 365 is a comprehensive feature that records user and admin activities across various services, including SharePoint Online, OneDrive for Business, Teams, and Azure Active Directory, not solely Exchange Online. Therefore, the absence of an Exchange mailbox for a user does not prevent the logging of their activities in other M365 services, such as file downloads or access, if audit logging is properly enabled at the tenant level. The Search-UnifiedAuditLog cmdlet queries this broad set of activities.
- ✗
The command syntax is incorrect
Why it's wrong here
The Search-UnifiedAuditLog cmdlet is the correct PowerShell command for retrieving audit records from the Microsoft 365 unified audit log. The parameters UserIds, Operations, and StartDate/EndDate are all valid and commonly used for filtering audit data. The syntax shown, assuming proper connection to Exchange Online PowerShell, is syntactically correct and would execute successfully if audit data were available to retrieve.
- ✗
The user did not download or access any files in the past 7 days
Why it's wrong here
If a user performed no file download or access operations within the specified 7-day period, the Search-UnifiedAuditLog command would return an empty result set for those specific operations. However, if audit logging were enabled for the tenant, the command would still successfully execute and indicate that no matching events were found, rather than failing to return any output or indicating a logging issue. An output that suggests no events at all points to a more fundamental logging problem.
- ✓
Audit logging is not enabled for the tenant
Why this is correct
For Search-UnifiedAuditLog to return any audit records, unified audit logging must first be explicitly enabled for the entire Microsoft 365 tenant. If this foundational setting is disabled, no user or administrator activities, including file downloads or access, are recorded in the audit log, regardless of user actions or command syntax. Consequently, any attempt to search the audit log will yield no results, indicating a lack of recorded data rather than a lack of activity or a syntax error.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Audit log
An audit log is a chronological record of security-relevant events and user activities within a system, used for monitoring, compliance, and forensic analysis.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.