Discuss Microsoft SC-200 Exam Topic 8 Question 30

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.

What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

Athe Threat Protection Status report in Microsoft Defender for Office 365

Bthe mailbox audit log in Exchange

Cthe Safe Attachments file types report in Microsoft Defender for Office 365

Dthe mail flow report in Exchange

Suggested Answer: A

To determine if ZAP moved your message, you can use either the Threat Protection Status report or Threat Explorer (and real-time detections).

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide

Get Premium SC-200 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Nobuko 12 months ago

The mail flow report might have some info, but not sure it's the best choice.

Georgeanna 1 year ago

Wait, can ZAP really be tracked like that? Sounds too easy!

Lizette 1 year ago

I agree, ZAP info is in the Threat Protection Status report.

Benedict 1 year ago

I think it's the mailbox audit log, not sure though.

Joanna 1 year ago

Definitely the Threat Protection Status report!

Bernardo 1 year ago

I’m confused about the Safe Attachments report; I don’t think it relates directly to ZAP, but I could be wrong.

Hui 1 year ago

I remember practicing a similar question, and I feel like the mailbox audit log could provide insights into email movements, but it might not specifically show ZAP actions.

Jovita 1 year ago

I think the Threat Protection Status report might be the right choice since it deals with ZAP, but I'm not entirely sure.

Vallie 1 year ago

I’m leaning towards option A, but I vaguely recall something about mail flow reports being useful for tracking email changes too.

Hannah 1 year ago

Hmm, I'm a bit confused by the different network isolation options presented. I'll need to carefully consider the details to determine the best solution.

Corazon 1 year ago

This question is tricky. I think configuring a mobility identity is related, but I can't recall if it directly affects blocked caller IDs.

Izetta 1 year ago

I feel pretty confident that the answer is Workflow. That term seems to best describe the automated process of moving the scanned images through the different stages, from the scan stations to the index stations. The other options don't seem to fit as well.

Microsoft SC-200 Exam - Topic 8 Question 30 Discussion