SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The user does not have an appropriate license

  Why it's wrong here

  The user's individual license typically determines their access to Microsoft 365 services and the activities they perform, which in turn generate audit logs. However, Microsoft Purview Audit (Standard) is a foundational auditing capability included with many common Microsoft 365 subscriptions, such as E3, F5, Business Standard, and Business Premium, at the organizational level. If the organization has enabled and uses Audit (Standard), it implies the necessary licensing is in place for the feature itself, and an individual user's license would not cause a systemic issue with log retention or availability for the entire organization.

• ✓

  Audit log retention is limited to 90 days for Audit (Standard)

  Why this is correct

  Microsoft Purview Audit (Standard) is specifically designed with a fixed retention period of 90 days for all audit logs. This means that any audit records generated will be automatically retained for exactly 90 days from their creation date. After this 90-day window expires, these logs are automatically and permanently purged from the system, making them irretrievable. This inherent limitation is a primary reason why older audit logs might appear to be missing.

• ✗

  The organization has insufficient storage

  Why it's wrong here

  Microsoft Purview Audit logs are stored and managed entirely within Microsoft's secure cloud infrastructure, not on the organization's local storage or tenant-specific allocated storage quotas. Microsoft is responsible for provisioning and maintaining the necessary storage capacity for all audit data generated by its services. Therefore, an organization's "insufficient storage" is not a relevant factor and would not lead to the loss or unavailability of audit logs within the Purview Audit service.

• ✗

  The audit logs were manually deleted by an administrator

  Why it's wrong here

  Microsoft Purview Audit logs are engineered with a critical security feature: immutability. This design prevents any user, including global administrators or compliance officers, from manually deleting individual audit records or purging the entire audit log database. This safeguard ensures the integrity and non-repudiation of the audit trail, making it impossible for an administrator to intentionally remove evidence of activities.

Go deeper

Related to this question