SC-200 Certification Practice Question #15

Question

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.
What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

Accepted Answer

MS Learn's ZAP article states ZAP is not recorded in the Exchange mailbox audit log, which directly eliminates B. The two MS-documented ways to see ZAP activity are the Mailflow status report and Threat Explorer — both Defender for Office 365 surfaces — and the Threat Protection Status report (a Defender for Office 365 report) explicitly counts messages handled by ZAP. Among the four offered choices, only A names a Defender for Office 365 report that includes ZAP; B contradicts the docs, C is a deprecated attachment-type report, and D references the Exchange mail flow report rather than the Defender Mailflow status report. Confidence is 84% rather than higher because the ideal MS-documented per-message tool (Threat Explorer) isn't an option, so A is the best available answer by elimination, and a meaningful minority argued for B/D.

More SC-200 practice questions