Exam MS-500 topic 4 question 31 discussion

The above answer is correct according to the document. https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide.

I think you need to lay out the test conditions too. the scenario talks about one single user being removed, so , in order for the modification of the dynamic query to affect a single user, it means it was trumping on a property that was not present on the other users. which, in real life, is rather unlikely. Gill's reasoning is valid here.

I go with subzero and gills, in real live you do not change the dynamic rule that often, but users frequently change some property that kicks him out of a group. Changing stuff like manager, dept, etc.. might cause the scenario.

-----"Updated User" yields no results! -> unless the user is eddited therefore kicked out from the group ----Updated group=> shows what user 'updated' the group. Probably because you edited the gruop to kick out the user If only 1 user is affected probably the change was made in the user and not in the group. I would say answers are right, anyway you have more chances to find the root cause if you look at to different things, the group and the user.

Reading through this whole thread, I agree with this. The ambiguity in the question is really annoying though. In this case we know the user was removed, and with dynamic groups than can only have two causes - the user changed, or the group filter changed. 'Remove user from group' would tell us that the user was removed because of a filter change, but would it tell us who made the change or what the change was? If the user change shows no results, you already know it was a filter change, so an audit telling you only that it was a filter change and not what kind of change is not very helpful. I can certainly see the argument for the given answer, however, since it also guarantees an answer to the prompt.

Cheers, makes sense.

Based on your testing, I'd conclude Remove member from group is not an answer. Look, we know the user is removed from the group, the question states you want to know _why_. As you verified, the reason can be one of the two update conditions, hence you need both these update conditions to search on. Only then you can be sure why the remove has taken place.

The testing is excellent. I think as the question states only User1 is no longer a member of the group and not all members, then the change has occured in the attributes of that user and the result is 'updated user' compared to 'updated group', assuming the above is correct.

My $0.02, changing a rule of the dynamic group affects a lot of users. So usually this is not the case when only one use user is affected.

Totally agree.