Microsoft Certified: Security Operations Analyst Associate Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  The Mail Flow report in the Exchange Admin Center (EAC) is useful for understanding general email traffic patterns, delivery issues, and trends, but it does not provide detailed information about ZAP actions. To confirm if ZAP moved a message, use: Microsoft 365 Defender > Threat Explorer (most detailed)

• Chose B1

  Explicação: O ZAP é um recurso do Microsoft Defender for Office 365 que: Remove automaticamente mensagens maliciosas ou phishing da caixa de entrada do usuário após a entrega, caso o conteúdo seja reclassificado como ameaça. Essa ação acontece no nível do Exchange, movendo o e-mail para o quarentena/lixo ou pasta de spam. Para verificar se o ZAP agiu, você precisa: ✔️ Acessar o log de auditoria da caixa de correio no Exchange Online. Esse log mostra: Quando uma mensagem foi movida. Quem/qual sistema realizou a ação. A ação "ZAP" aparece registrada como um evento de movimentação automática.

• Chose B4

  While the Threat Protection Status report in Microsoft Defender for Office 365 provides an overview of threats detected and actions taken, it doesn't specifically track individual email movements caused by zero-hour auto purge (ZAP). The mailbox audit log in Exchange is more precise for this purpose because it logs detailed actions on emails, including those moved by ZAP. This allows you to see exactly when and why an email was moved from a user's mailbox.