SC-401 Practice Question 3666

Exam: SC-401
Domain: Manage risks, alerts, and activities
Difficulty: easy
You need to verify if an administrator turned off audit logging in Microsoft Purview. Which PowerShell cmdlet checks whether unified audit logging is currently enabled for the tenant?

Answer Options

A
Get-AdminAuditLogConfig (UnifiedAuditLogIngestionEnabled)
B
Get-Process -Name AuditLog
C
Test-NetConnection -Port 80
D
Set-ExecutionPolicy Unrestricted

Correct Answer

A: Get-AdminAuditLogConfig (UnifiedAuditLogIngestionEnabled)

Explanation

The `Get-AdminAuditLogConfig` cmdlet (inspecting the `UnifiedAuditLogIngestionEnabled` property) verifies if unified audit logging is active across the tenant.
Reference: https://learn.microsoft.com/en-us/powershell/module/exchange/get-adminauditlogconfig

Related Practice Questions

SC-401 Practice Question 3506SC-401 Practice Question 3507SC-401 Practice Question 3508