SC-401 Question #47: Real Exam Question with Answer & Explanation

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. You have a user named User1. Several users have full access to the mailbox of User1. Some email messages sent to User1 appear to have been read and deleted before the user viewed them. When you search the audit log in the Microsoft Purview portal to identify who signed in to the mailbox of User1, the results are blank. You need to ensure that you can view future sign-ins to the mailbox of User1. Solution: You run the Set-Mailbox -Identity "User1" -AuditEnabled $true command. Does that meet the goal?

Options

• AYes
• BNo

Explanation

{"question_number": 4, "question_summary": "Audit log blank for mailbox sign-ins - proposed solution WORKS (Answer: Yes)", "correct_answer": "A", "explanation": "This solution works because it specifically adds the MailboxLogin action to the mailbox audit configuration - for example, running: Set-Mailbox -Identity User1 -AuditOwner @{Add='MailboxLogin'}. MailboxLogin tracks when a user directly signs in to a mailbox and is not audited by default in Microsoft 365. By explicitly enabling this audit action, subsequent sign-ins to User1's mailbox will be recorded in the audit log, allowing the administrator to identify who accessed the mailbox. This directly addresses the blank audit results and meets the stated goal, so the answer is Yes.", "generated_by": "claude-sonnet", "llm_judge_score": 4}

No community discussion yet for this question.