Exam MS-101 topic 3 question 59 discussion

Actual exam question from Microsoft's MS-101

Question #: 59
Topic #: 3

HOTSPOT -
You have a Microsoft 365 E5 subscription that contains two users named Admin1 and Admin2.
All users are assigned a Microsoft 365 Enterprise E5 license and auditing is turned on.
You create the audit retention policy shown in the exhibit. (Click the Exhibit tab.)

After Policy1 is created, the following actions are performed:
✑ Admin1 creates a user named User1.
✑ Admin2 creates a user named User2.
How long will the audit events for the creation of User1 and User2 be retained? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/audit-log-retention-policies?view=o365-worldwide

by ALPHA_DELTA at April 5, 2021, 7:18 p.m.

Comments

Submit Cancel

ALPHA_DELTA

Highly Voted 4 years, 2 months ago

Admin 1 who created user 1 has the policy applied which indicates only keep the audit log for 90 days. Admin 2 who created user 2 does not have a policy applied. Since all users are assigned an E5 license then the audit log will be kept for 1 year "To retain an audit log for longer than 90 days (and up to 1 year), the user who generates the audit log (by performing an audited activity) must be assigned an Office 365 E5 or Microsoft 365 E5 license or have a Microsoft 365 E5 Compliance or E5 eDiscovery and Audit add-on license." https://docs.microsoft.com/en-us/microsoft-365/compliance/audit-log-retention-policies?view=o365-worldwide

upvoted 33 times

...

potpal

Highly Voted 4 years, 1 month ago

On test taken 5.10.21

upvoted 12 times

...

Amir1909

Most Recent 1 year, 4 months ago

6 months both

upvoted 1 times

...

MartyT

3 years, 5 months ago

I think this should be 365 for both User1 and User2 as all users are E5 and neither User1 nor User2 are referenced in the policy with 90 days(that is Admin1 only).

upvoted 1 times

Glen711

3 years, 2 months ago

But Admin1 is taking the action to create User1. Therefore the custom policy applies to the action because Admin1 took the action. So the 90 days thing would apply to that one.

upvoted 4 times

...

Jake1

4 years, 1 month ago

I was confused about this b/c E5 audits are kept for 1 year but then I saw Nunununu's explanation and it makes sense. With that said, Answers are correct.

upvoted 2 times

...

Nunununu

4 years, 2 months ago

All custom audit log retention policies (created by your organization) take priority over the default retention policy. For example, if you create an audit log retention policy for Exchange mailbox activity that has a retention period that's shorter than one year, audit records for Exchange mailbox activities will be retained for the shorter duration specified by the custom policy.

upvoted 5 times

...