SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Exhibit
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -Operations FileDeleted -ResultSize 1000
Refer to the exhibit. You run the PowerShell command to search the unified audit log for file deletions. The command returns no results, but you know a file was deleted last week. What is the most likely reason?
⚠ Common exam trap
Watch out — candidates often assume the operation name is incorrect or that the date range is wrong, but the core issue is that audit logging must be enabled as a prerequisite for any audit record generation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Audit logging is not enabled for the organization
The most likely reason is that audit logging is not enabled for the organization. In Microsoft 365, unified audit log search requires that audit logging be explicitly turned on (by default, it is enabled for most tenants, but it can be disabled). If audit logging is disabled, no audit records are generated, so any search—including for 'FileDeleted' operations—will return no results, even if files were actually deleted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The operation name 'FileDeleted' is incorrect
Why it's wrong here
The operation name 'FileDeleted' is a standard and recognized event type within the Microsoft 365 unified audit log, specifically indicating a file deletion action in services like SharePoint Online or OneDrive for Business. Therefore, using 'FileDeleted' in the `Operations` parameter of `Search-UnifiedAuditLog` is technically correct and would not be the reason for an empty result set if audit data existed.
- ✓
Audit logging is not enabled for the organization
Why this is correct
The Microsoft 365 unified audit log is not enabled by default for all organizations; it requires explicit activation by an administrator within the Microsoft 365 compliance center or via PowerShell. If audit logging has not been enabled, no audit records are collected or stored, meaning any search, regardless of correct parameters, will return an empty result set. This fundamental prerequisite is essential for any audit data to be available.
- ✗
Audit logs are only retained for 90 days
Why it's wrong here
The default retention period for most Microsoft 365 audit logs is 90 days for standard subscriptions, with extended retention available for E5 licenses or specific add-ons. A search for events occurring within the last 7 days falls well within even the most basic 90-day retention policy. Therefore, log retention limits would not prevent the retrieval of audit records from the previous week.
- ✗
The StartDate and EndDate are incorrect
Why it's wrong here
Specifying a `StartDate` and `EndDate` that encompass the previous week is a perfectly valid and common practice when querying audit logs for recent activity. PowerShell cmdlets like `Search-UnifiedAuditLog` are designed to accept such date ranges, and a one-week period is well within the acceptable scope for a targeted audit search. The provided date parameters are syntactically and logically correct for retrieving recent audit data.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.