nerdexam
Microsoft

MS-102 · Question #474

Your company has a Microsoft 365 subscription. You need to identify which users performed the following privileged administration tasks: - Deleted a folder from the second-stage Recycle Bin of…

The correct answer is D. Microsoft 365 compliance audit log search. The M365 Compliance audit log (now found at compliance.microsoft.com) contains everything required in order to ascertain who made the changes specified within the question. https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and…

Submitted by naveen.iyer· Apr 18, 2026Manage compliance by using Microsoft Purview

Question

Your company has a Microsoft 365 subscription. You need to identify which users performed the following privileged administration tasks:

  • Deleted a folder from the second-stage Recycle Bin of Microsoft

SharePoint

  • Opened a mailbox of which the user was not the owner
  • Reset a user password

What should you use?

Options

  • AMicrosoft Azure Active Directory (Azure AD) audit logs
  • BMicrosoft 365 compliance content search
  • CMicrosoft Azure Active Directory (Azure AD) sign-ins
  • DMicrosoft 365 compliance audit log search

How the community answered

(29 responses)
  • A
    3% (1)
  • B
    14% (4)
  • C
    10% (3)
  • D
    72% (21)

Explanation

The M365 Compliance audit log (now found at compliance.microsoft.com) contains everything required in order to ascertain who made the changes specified within the question. https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and- compliance?view=o365-worldwide

Topics

#Compliance audit log#Privileged operations#SharePoint auditing#Mailbox access

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full MS-102 Practice