Microsoft · SC-401
Audit, alerts, and searches
SC-401 · Lesson 12 of 13 · 1:11:29
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-401 exam (Microsoft Certified: Information Security Administrator Associate). In this lesson: Audit Standard and Premium (retention, MailItemsAccessed, Advanced Auditing per user), audit searches and roles, audit retention policies, Activity explorer, responding to DLP alerts in Purview and in the Defender portal, Defender for Cloud Apps alerts, and eDiscovery searches, holds, and exports. Includes three original practice questions.
Preview the topics
- A company has E5 licenses, but searches for MailItemsAccessed return nothing for one user. What’s the likely cause?
- A DLP alert looks like part of a bigger pattern: a download, an upload to a personal account, and an external share. Where is it best seen in context?
- Legal must find, preserve, and export every email and Teams message about a merger, for outside counsel. What should be used?