Exam SC-200 topic 6 question 19 discussion

E. Tactic 1, Tactic 2, and Tactic 3 (with caveat): Why: Tactic 1 and Tactic 2 are definitively in MicrosoftGraphActivityLogs. Tactic 3 (VM deletion) isn’t typically Graph API, but if the attacker used Graph API for related Azure enumeration (e.g., /organization), it might be partially traceable. However, deletion itself is in AzureActivity. E assumes all tactics use Graph API, though Tactic 3 stretches this—likely a question intent vs. technical mismatch.

Another vague question. Answer is Tactic1 & Tactic2. But as there is no such option in the answers, go for "E".

is options are incorrect: Tactic3: Deletes Azure virtual machines Deleting Azure virtual machines is more of an Azure Resource Manager (ARM) operation rather than a Microsoft 365 or Microsoft Graph API-specific action. This would typically be logged in Azure Activity Logs, not the MicrosoftGraphActivityLogs.

From ChatGPT: Tactic1: Discovers misconfigured mailboxes - This would involve API calls to access mailbox settings and configurations, which would be logged in the MicrosoftGraphActivityLogs table. Tactic2: Searches Microsoft Teams chats and exports full conversations - This involves accessing Microsoft Teams data through API calls, which would also be logged in the MicrosoftGraphActivityLogs table. Tactic3: Deletes Azure virtual machines - This is an action related to Azure Resource Management, which might not be directly logged in the MicrosoftGraphActivityLogs table. This activity is more likely to be found in Azure activity logs. Why there is no option 1 and 2?