Exam SC-400 topic 5 question 15 discussion

I think - User1 renames a SharePoint site: 6 months Because audit3 has higher priority than audit4 & 5. The activity is set to 'none' which means that it applies to all activities within the specified record type.. so this includes siterename activity. - User2 sends an email message: 6 months Because from october 2023 the default retention period is 180 days, logs generated before october (17th) 2023 has default period of 90 days. And there is no custom policy assigned to user2 for sending emails. https://learn.microsoft.com/en-us/purview/audit-log-retention-policies

so... audit log retention policies doesn't follow retention policies rules. Priority take over retention. The default for E5 is 1 years, for standard is 180 days ( from october 2023 ). The 10 years audit log can be taken only if you have E5 + add-on for 10 years retention policies, so it's excluded from the list. User 1 who is part of auditretention 3 and audit retention 4, will have his activities taken for 6 months, because when no activities is selected, all are followed and you must choose the user. For the second answer, we have to keep in mind that user has E5, so because User 2 is not part for any of the auditretention policies, he'll follow default policy -> 1 year

There are Audits: Standard - 90 days Premium - 1 Yr (and up to 10 yr)