SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization has a Microsoft Purview compliance portal. You need to audit who deleted a specific file from SharePoint Online last week. What should you do?
⚠ Common exam trap
Many candidates confuse eDiscovery Content Search (which finds content) with the unified audit log (which finds actions), leading them to choose Option A instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Search the unified audit log in Microsoft Purview
The unified audit log in Microsoft Purview records all user and admin activities, including file deletions in SharePoint Online. By searching this log, you can find the specific event that shows who deleted the file, when it happened, and from which location. This is the correct tool for auditing past actions like file deletions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Content Search in eDiscovery
Why it's wrong here
Using Content Search in eDiscovery is designed to locate specific content, such as emails, documents, or chat messages, across various Microsoft 365 services based on keywords, dates, and other properties. While essential for legal holds and regulatory requests, this feature focuses on the data itself and its properties, not on recording or reporting the actions performed by users or administrators on that content. It does not provide an audit trail of who accessed, modified, or deleted an item.
- ✓
Search the unified audit log in Microsoft Purview
Why this is correct
Searching the unified audit log in Microsoft Purview is the correct approach because it provides a comprehensive record of user and administrator activities across a wide range of Microsoft 365 services, including Exchange Online, SharePoint Online, Teams, and Azure Active Directory. This log captures detailed information about specific actions performed, such as file access, permission changes, mailbox operations, and administrative configurations, along with timestamps, user identities, and IP addresses. It is the definitive source for investigating 'who did what, when, and where' within the organization's Microsoft 365 environment.
- ✗
Configure a retention policy for SharePoint
Why it's wrong here
Configuring a retention policy for SharePoint is a data governance mechanism used to preserve or delete content based on specific organizational or regulatory requirements over a defined period. While crucial for compliance by ensuring data availability or deletion, a retention policy solely manages the lifecycle of the data itself. It does not generate, store, or provide a log of individual user or administrator actions performed on the SharePoint content, making it unsuitable for auditing activities.
- ✗
Review the data classification dashboard
Why it's wrong here
Reviewing the data classification dashboard provides an overview of how sensitive information is identified, labeled, and protected across your organization's data landscape. This dashboard visualizes the distribution of sensitive info types, sensitivity labels, and trainable classifiers, offering insights into data governance posture. However, its purpose is to report on the classification status of data, not to track or display specific audit events or user activities related to accessing, modifying, or managing that data.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Audit log
An audit log is a chronological record of security-relevant events and user activities within a system, used for monitoring, compliance, and forensic analysis.
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.