StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Security operations detection and response

Practice question 90 of 498 · hard

A company wants long-term SIEM evidence and must investigate a specific mailbox read. Which two planning actions address these needs? Select two.

Select all that apply. Every correct option and no extras are required for credit in the app.

  1. A.Give every employee audit-search privileges
  2. B.Validate the needed high-value audit events and user licensing
  3. C.Design supported API collection with independent destination retention
  4. D.Assume a new policy recovers records already expired
  5. E.Retain only incident summaries instead of source events
Show the answer and explanation

✓ Correct answers

  • Validate the needed high-value audit events and user licensing
  • Design supported API collection with independent destination retention

Validate event availability/licensing and supported collection into a retained destination. Expired records cannot be recovered by a new policy, incident summaries omit audit detail, and broad search access exposes sensitive evidence.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.