Exam SC-401 Topic 1 Question 279 Discussion

Actual exam question for Microsoft's SC-401 exam
Question #: 279
Topic #: 1
Hotspot Question
You have a Microsoft 365 subscription that uses Microsoft Purview.
You need to investigate the following events:
- Events that occurred two months ago
- Events in which users accessed encrypted email by using a one-time
passcode (OTP)
Which Microsoft Purview solution should you use, and which type of record should you query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Suggested Answer:


Explanation:
To investigate events where external users accessed encrypted email using a one-time passcode (OTP), you must use the following configuration in your query:
Microsoft Purview Feature: Audit (Standard) or Audit (Premium) (using the Audit log search tool) Record Type: OMEPortal Box 1: Audit The Audit search feature in the Microsoft Purview compliance portal tracks all user and administrator activities across Microsoft 365 services. Since the default retention period for Microsoft Purview Audit (Standard) is 180 days, it fully supports investigating events that occurred two months ago.
Box 2: OMEPortal
When a recipient signs into the Office 365 Message Encryption portal via a one-time passcode (OTP), the event is recorded under a specific schema.The required record type filter for the query is OMEPortal.This records operations such as external user authentication methods, message views, and attachment downloads.
Reference:
https://learn.microsoft.com/en-us/purview/audit-log-activities
https://learn.microsoft.com/en-us/office/office-365-management-api/omeportal

by Gustave at Jul 15, 2026, 06:13 AM

Limited Time Offer

15%

Off

Get Premium SC-401 Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10