Exam SC-400 topic 5 question 8 discussion

Actual exam question from Microsoft's SC-400

Question #: 8
Topic #: 5

HOTSPOT
-

You have a Microsoft 365 subscription. Auditing is enabled.

A user named User1 is a member of a dynamic security group named Group1.

You discover that User1 is no longer a member of Group1.

You need to search the audit log to identify why User1 was removed from Group1.

Which two activities should you use in the search? To answer, select the appropriate activities in the answer area.

Show Suggested Answer

Suggested Answer:

by izgi43 at Nov. 9, 2023, 11:15 p.m.

Comments

Submit Cancel

EsamiTopici

Highly Voted 1 year, 1 month ago

Updated user and uptaded group?

upvoted 7 times

Don_Barriga

8 months, 3 weeks ago

I agree, also copilot does.

upvoted 2 times

...

Kuteron

Most Recent 8 months ago

Got the time and testet it: Answer is: - Updated group => shows what user 'updated' the group. - Removed member from group => shows the user that was removed (by modifying dynamic the query)

upvoted 2 times

...

PsiCzar

11 months, 1 week ago

This is wrong, you cant manually add/remove a user from a dynamic group. If the user has been removed from the group, the query no longer matches their account, so either the user has been updated or the group has been updated. https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership

upvoted 3 times

...

izgi43

1 year, 8 months ago

on the exam thu nov 9

upvoted 2 times

...