SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Which TWO scenarios are appropriate uses of Microsoft Purview Audit (Standard)?
⚠ Common exam trap
Many candidates assume all audit events are available in Audit (Standard), but Microsoft deliberately restricts high-value events like sensitivity label tracking and long-term retention to Audit (Premium), making options D and E tempting but incorrect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigating a user who accessed a sensitive file in SharePoint.
Microsoft Purview Audit (Standard) logs key events such as file access and admin activities, and retains logs for 90 days. Option A is correct because accessing a sensitive file in SharePoint generates an audit event captured by Audit (Standard). Option B is correct because searching the audit log for admin activities within the 90-day retention period is a core capability of Audit (Standard).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Investigating a user who accessed a sensitive file in SharePoint.
Why this is correct
Microsoft Purview Audit (Standard) is specifically designed to capture and log user activities across Microsoft 365 services, including SharePoint Online. This capability allows security administrators to efficiently search the unified audit log for specific events, such as a user accessing, viewing, or downloading a sensitive file, making it an appropriate and primary tool for investigating potential data breaches or unauthorized access incidents.
- ✓
Searching the audit log for admin activities in the past 60 days.
Why this is correct
Microsoft Purview Audit (Standard) provides a unified audit log that records a wide array of administrative activities across various Microsoft 365 services, including Exchange Online, SharePoint Online, and Azure AD. The service retains these audit logs for a default period of 90 days, which fully supports searching for and analyzing administrator actions performed within the past 60 days directly through the Microsoft Purview compliance portal.
- ✗
Generating custom reports with PowerShell for all activities.
Why it's wrong here
While PowerShell cmdlets like `Search-UnifiedAuditLog` can retrieve audit data, generating comprehensive custom reports for *all* activities with advanced filtering, aggregation, or automated delivery is often limited by the default capabilities of Audit (Standard). More sophisticated, extensive, and automated reporting typically requires integrating with external Security Information and Event Management (SIEM) solutions or leveraging the advanced data export features of Audit (Premium).
- ✗
Tracking when sensitivity labels are applied to documents.
Why it's wrong here
Tracking specific, detailed events related to sensitivity labels, such as when a label is applied, changed, or removed from a document, generally requires the enhanced logging capabilities provided by Microsoft Purview Audit (Premium). While Audit (Standard) logs some basic file activities, the granular logging of sensitivity label interactions, crucial for comprehensive data governance and compliance auditing, is a feature primarily associated with Audit (Premium) due to its richer event schema.
- ✗
Retaining audit logs for 2 years for compliance purposes.
Why it's wrong here
Microsoft Purview Audit (Standard) has a default retention period of 90 days for audit logs, which is insufficient for compliance requirements demanding 2-year retention. To meet such long-term compliance obligations, organizations must leverage Microsoft Purview Audit (Premium), which offers customizable retention policies, including the ability to retain logs for up to 10 years to satisfy stringent regulatory mandates.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.