MicrosoftMicrosoft
MS-900 · Question #168
MS-900 Question #168: Real Exam Question with Answer & Explanation
The correct answer is D: Security & Compliance audit log search. These activities are listed in the S&C audit log search but not in the Azure audit logs.
Submitted by ricky.ec· Mar 5, 2026Describe security, compliance, privacy, and trust in Microsoft 365
Question
Your company has a Microsoft 365 subscription. You need to identify which users performed the following privileged administration tasks: - Deleted a folder from the second-stage Recycle Bin of Microsoft SharePoint - Opened a mailbox of which the user was not the owner - Reset a user password What should you use?
Options
- AMicrosoft Azure Active Directory (Azure AD) audit logs
- BSecurity & Compliance content search
- CMicrosoft Azure Active Directory (Azure AD) sign-ins
- DSecurity & Compliance audit log search
Explanation
These activities are listed in the S&C audit log search but not in the Azure audit logs.
Topics
#Audit logging#Security & Compliance Center#SharePoint Online#Exchange Online#User activity monitoring
Community Discussion
No community discussion yet for this question.