Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

SC-400 > Monitor and investigate data and activities > Flashcards

Monitor and investigate data and activities Flashcards

1
Q

What are the functionalities of Content Search? (2)

A

Search and export

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the functionalities of eDiscovery Standard? (3)

A

All of Content Search + case management and legal holds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the functionalities of eDiscovery Premium? (8)

A

All of eDiscovery Standard +
1) Assign case to people outside of your organization
2) legal hold notification
3) advanced indexing
4) tagging
5) analytics e.g., ML-based predictive coding
6) end-to-end workflow
7) OCR
8) review sets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the functionality that helps reducing the number of content match to the most useful one?

A

ML based predictive coding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the limitations of Content Search in a hybrid Exchange set-up?

A

You cannot search on-premise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the maximum number of conditions in a Content Search query?

A

100

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a Review Set?

A

A secure Microsoft-provided Azure storage location where the the result of a search can be added. It is possible to export to customer owner location. This is a eDiscovery Premium feature.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the two things you need to open exported search results?

A

1) Export Key 2) eDiscovery Export Tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the search preview limitations? (3)

A

1000 files or max 100/location (whichever is smaller), Other elements than Emails in Outlook (calendar items, tasks, contacts, folders, lists)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

On which standards is the M365 Baseline Score based on? (3)

A

NIST CSF, ISO and FedRAMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What can you add in addition to users when adding people that will be able to manage an ediscovery case?

A

Role groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How long does it take for a eDiscovery hold to take effect?

A

Up to 24 hours

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When creating a eDiscovery hold, for which location do you need to select the specific locations where it will apply?

A

Exchange (specific mailboxes) and SharePoint (specific sites)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the two options to download a eDiscovery case?

A

1) Using a Microsoft provided Azure space to export outside of the organization 2) Using eDiscovery Export Tool to download locally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How is the compliance score determined?

A

It is the sum of the improvement actions scores, which depend on whether the action is mandatory/discretionary and if it is preventive/detective/corrective.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the difference between technical and non-technical remediation actions in how they affect the compliance score?

A

Non-technical are counted only once per Group, while technical are counted once

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

To which format is data from a Content Search exported?

A

Email: PST
SharePoint/OneDrive: Native document format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the 3 technical requirements to be able to export Content Search?

A

1) Latest Windows or .NET Framework
2) Edge
3) being connected to the temporary Azure space where the files will be stored temporarily

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How long are results of a Content Search stored for?

A

2 weeks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Why should you protect the Export Key?

A

Because it can be used by anyone to download search results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What other information does an export from Content Search contains? (4)

A

1) Summary
2) Errors
3) Skipped items reports
4) trace log about the export process
Note that it is also possible to only download these reports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are three tips to speed the download of the Content Search exports?

A

1) Disabled anti-virus scanning
2) Download only to internal drive (no network/external drive or OneDrive)
3) Download to different folders for concurrent download jobs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Search Permission Filers?

A

It limits what an eDiscovery manager is able to search for (content/location)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the PowerShell command to limit what an eDiscovery Manager is able to search for?

A

New-ComplianceSecurityFilter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What does the New-ComplianceSecurityFilter do?
It limits what an eDiscovery manager is able to search for (content/location)
26
What role group must you be part of in order to use New-ComplianceSecurityFilter?
Organization Management
27
What are the limitations when deleting content identified via a Content Search? (4)
1) Other locations than Exchange Online mailboxes and public folders. 2) Max 10 items per mailbox at a time 3) Max 50'000 mailboxes 4) Content in a review set (i.e., only content from live system can be deleted)
28
What should you do if you want to delete content from more than 50k mailboxes?
Use Search Permission Filters to reduce the scope of the search to e.g., one department
29
What are the steps to search and delete content? What is the PowerShell command to delete?
1) Connect to the Securit&Compliance module in PowerShell 2) Run the search (in PowerShell or in Purview) 3) Delete using New-ComplianceSearch Action -Purge
30
What does the Assessment tab of the Compliance Manager area contains?
List of compliance/security/privacy standard and underlying controls
31
How can you update the improvement actions from the Compliance Manager?
By downloading them into a ExportActions.xlsx file and updating them in Excel
32
Is 10-year audit retention included in E5 license?
No, this has to be purchased as an add-on license for each user
33
When creating an alert based on unusual activity, how long does it take for the baseline to be created?
7 days
34
When implementing an improvement action, how long does it take for the Compliance Manager portal to be updated?
Up to 24 hours
35
What can a eDiscovery Manager do? (5)
1) Create/manage eDiscovery cases 2) Add/remove members/custodians to a case 3) Place hold 4) Create/edit searche 5) Export content
36
What can a eDiscovery Administrator do that a eDiscovery Manager can't? (2)
1) View and manage any case 2) Remove members of any eDiscovery cases
37
Which role groups can create cases?
eDiscovery Manager/Admin and Organization Management
38
What is the maximum number of keywords in a combined hold + search query?
500
39
What happens if the maximum number of keywords in a combined hold + search query is reached?
The entire mailbox is searched
40
How long does it take for a hold removal to take effect and how is this called?
30 days - Delay hold
41
What is the difference between closed and deleted cases?
A closed case only means that the holds are turned off, but it is still possible to create/export searches and to re-open it, while a deleted case removes all data associated to it (no re-open possible)
42
How long does it take for the closing or re-opening process of an ediscovery case to complete?
60 min
43
What should you pay attention to when re-opening a case?
It does not automatically re-activate the holds
44
What should you pay attention to when deleting a case?
You must first delete all the holds, else you will get an error
45
If you add a Group to a search settings, what will be searched?
The Group mailbox only, NOT the mailboxes of the group members
46
What additional functionalities does Audit Premium offers compared to Audit Standard? (5)
1) Audit log retention policies up to 10 years 2) Intelligent insights 3) More capabilities for searches e.g., more events to search 4) Higher bandwidth for searches through the O365 Management APO 5) 1 year default retention policy instead of 180 days for OneDrive, Exchange, SharePoint and Entra
47
What is the baseline bandwidth for searches?
2000 researches/minute
48
Which role group is able to turn on and off automated remediation action for all actions globally?
Global Admin, and it is the only one
49
What actions are you able to perform on history of users working on remediation actions? (3)
Export, re-assign and delete
50
Which model does the built-in workflow for eDiscovery alignes with?
Electronic Discovery Reference Model
51
What are Data Custodians?
Users of interest that can be added to a case
52
Which of these require a M365 E5 licence: data custodians, users added as manager/lawyers of an eDiscovery case?
Only the data custodians
53
What is advanced re-indexing?
It re-indexes the content associated to a custodian, to allow the content to be easily searchable
54
What should you pay attention to when associating other data sources to a data custodian?
For Teams and Viva, you need to add both the mailbox and the site (adding one does not automatically add the other)
55
What is the maximum number of documents that can be added to a case?
40 millions
56
What is the maximum volume of data that can be collected in a single collection?
1TB
57
What is the maximum volume of data that can be put in a review set (pre-expansion)?
1TB
58
In which format are the Teams/Viva conversations stored?
HTML
59
What is the maximum capacity supported by the export job?
Min (500GB : 5 million documents)
60
What are 3 data analysis tools proposed in eDiscovery Premium?
1) Near duplicate detection 2) Email threading 3) Theme (i.e, assigning a dominent theme to a conversation)h
61
What is a pivot?
When performing near duplicate detection, Microsoft groups textually similar documents and defines a pivot, which is the document that all other documents within the near duplicate group are compared to.
62
What are the 4 categories in which email messages are divided into?
1) Inclusive 2) Inclusive minus 3) Inclusive copy 4) None
63
What does the "Inclusive" email message type entails?
The final email message in an email threat, which contains all the previous content of that email thread
64
What does the "Inclusive minus" email message type entails?
An email message that has one or more attachments associated with it
65
What does the "Inclusive copy" email message type entails?
An email message that is an exact copy of an Inclusive or Inclusive minus message
65
What does the "None" email message type entails?
An email message whose content is wholly contained in at least one other email message marked as Inclusive or Inclusive minus
66
What is the PoweShell command to search audit events?
Search-UnifiedAuditLog
67
What is the role required to search audit log?
View-Only Audit Log
68
How can you search multiple audit events in PowerShell?
As the Search-UnifiedAuditLog supports only one event per query, you need to append the second query to the the first CSV search results
69
How many user and admin activities are being logged?
Over 100
70
How many events can be returned in one audit search?
Max 50k
71
The IP field of my search result is blank, why? (2)
Because the activity that was logged was performed by 1) an admin 2) a system account of Microsoft Entra related event
72
The IP field of my search result is not that of the user who performed the action, why?
When a trust application is calling a service on behalf of a user, its IP address is logged instead of the one from the user
73
What does the AuditData column of the audit export data CSV contains?
Additional information about the event in JSON format (field are event-specific)ow
74
How can you extract the AuditData JSON into columns in Excel, and what you should pay attention to when performing this?
Using PoweQuery Editor, but it will only look at the properties of the first 1000 rows
75
What is one limitation of mailbox auditing?
It does not record activities performed by delegate users
76
What are the two possible commands to search mailbox audit for specific users?
Search-MailboxAuditLog New Mailbox Audit Log Search
77
To use Audit Premium functionalities, is it sufficient that the person performing the audit has an E5 license?
No, the user whose data you want to retain or use E5 functionalities for such as special types of events needs an E5 license
78
What are the new events that can be recorded in Audit Premium? And which of these first require to be enabled in PoweShell before they are logged?
MailItemAccessed Send SearchQueryInitiatedExchange => need to be enabled in PowerShell SearchQueryInitatedSharePoint => need to be enabled in PowerShell
79
What is the event name corresponding to "MailItemAccessed" cmdlet?
Accessed mailbox items
80
What is the event name corresponding to "Send" cmdlet?
Sent message (incl. reply, forward, send email)
81
What is the event name corresponding to "SearchQueryInitiatedExchange" cmdlet?
Performed email search
82
How does bandwidth of the API using Audit Premium differs from Audit Standard?
Standard: Publisher-level limit Premium: Tenant-level limit Baseline is 2000 requests/minute in both cases, that can automatically increase based on the org seat count and license (for Premium it can increase more, as the limit is at tenant level)
83
How many audit log retention policies can you define?
Max 50
84
Is it possible to edit the default audit log retention policy?
No, and it is not display. Custom retention policies take precedence over the default one.
85
What is the PowerShell command to set an audit log retention policy?
New-UnifiedAuditLogRetentionPolicy
86
What is the PowerShell command to 1) view 2) Edit 3) Delete an audit log retention policy?
1) Get 2) Set 3) Remove
87
What is the difference between sync and bind MailItemAccessed?
Bind: Individual access to email message (one event per mail item) Sync: Desktop version of Outlook accessing the mailbox (only one event per sync, not per mail item)
88
What is the limitation of bind audit log generation?
It stops generating bind audit log if there are more than 1000 records created in less than 24 hours
89

SC-400 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions