Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

GIAC GCFR Exam - Topic 12 Question 53 Discussion

An investigator is evaluating a client's Microsoft 365 deployment using the web portals and has identified that the Purview compliance portal states that the Unified Audit Logs are not enabled. Based on the additional Information gathered below, what is most likely the cause of this configuration message?Subscription creation date: December 4, 2021 Number of administrators: 2 Number of non-administrative user accounts: 74 Last tenant administration change: December 4,2021
D) Default configuration, service was never enabled
A) Explicitly been disabled by an administrator
B) License was downgraded lower than an E5 license
C) Tenant is configured to forward logs externally

GIAC GCFR Exam - Topic 12 Question 53 Discussion

Actual exam question for GIAC's GCFR exam
Question #: 53
Topic #: 12
[All GCFR Questions]

An investigator is evaluating a client's Microsoft 365 deployment using the web portals and has identified that the Purview compliance portal states that the Unified Audit Logs are not enabled. Based on the additional Information gathered below, what is most likely the cause of this configuration message?

Subscription creation date: December 4, 2021 Number of administrators: 2 Number of non-administrative user accounts: 74 Last tenant administration change: December 4,2021

Show Suggested Answer Hide Answer
Suggested Answer: D

by Elmer at Mar 09, 2026, 01:06 AM

Limited Time Offer

25%

Off

Get Premium GCFR Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Ira
3 days ago
I agree, D makes sense. Default settings often get overlooked.
upvoted 0 times
...
Eun
8 days ago
I think it's D. The service was never enabled.
upvoted 0 times
...
Temeka
13 days ago
B could be a factor too. Downgrading licenses can affect features.
upvoted 0 times
...
Mira
19 days ago
I lean towards A. Maybe an admin disabled it by mistake.
upvoted 0 times
...
Silvana
24 days ago
Agreed, D makes sense. Default settings often get overlooked.
upvoted 0 times
...
Willow
29 days ago
I think it's D. The service was never enabled.
upvoted 0 times
...
Herminia
1 month ago
True, but with no changes since 2021, D seems more likely.
upvoted 0 times
...
Curt
1 month ago
But what about A? An admin could have disabled it.
upvoted 0 times
...
Jacquelyne
1 month ago
I agree, D makes sense. Default settings often get overlooked.
upvoted 0 times
...
Dean
2 months ago
I think it's D. The service was never enabled.
upvoted 0 times
...
Sharmaine
2 months ago
I think it’s C, forwarding logs could mess things up.
upvoted 0 times
...
Hobert
2 months ago
Definitely A, an admin probably turned it off.
upvoted 0 times
...
Bong
4 months ago
Surprised to see that logs aren't enabled by default!
upvoted 0 times
...
Anjelica
4 months ago
I disagree, it could be B if they downgraded the license.
upvoted 0 times
...
Luther
4 months ago
Sounds like it was never enabled, so D makes sense.
upvoted 0 times
...
Cathern
4 months ago
C seems unlikely, most tenants keep logs internally.
upvoted 0 times
...
Arthur
4 months ago
Definitely not B, they have enough users for E5.
upvoted 0 times
...
Hubert
4 months ago
Surprised to see this! I thought it was on by default.
upvoted 0 times
...
Chanel
5 months ago
I disagree, it could be A if someone turned it off.
upvoted 0 times
...
Inocencia
5 months ago
Sounds like it was never enabled, so D makes sense.
upvoted 0 times
...
Ammie
5 months ago
I’m not completely sure, but I feel like forwarding logs externally might not be the issue here since it usually doesn't affect the audit logs directly.
upvoted 0 times
...
Glendora
5 months ago
The last admin change was on the same day as the subscription creation. Maybe it was just never enabled by default?
upvoted 0 times
...
Katheryn
5 months ago
I think I saw a similar question where the licensing affected features. Could it be related to the E5 license downgrade?
upvoted 0 times
...
Nichelle
5 months ago
I remember reading that sometimes the audit logs can be disabled by an admin, but I'm not sure if that's the only reason.
upvoted 0 times
...

Save Cancel