SC-200 Certification Practice Question #210

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Exchange Online.

You need to identify phishing email messages.

Which three cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

Accepted Answer

Identifying (and later remediating) phishing messages across all mailboxes uses the eDiscovery/Compliance Search workflow, which runs in **Security & Compliance PowerShell**. You connect there with **Connect-IPPSSession**, define the search with **New-ComplianceSearch**, then execute it with **Start-ComplianceSearch** — exactly the order MS Learn documents. The competing claim to use **Connect-ExchangeOnline** is wrong because that connects to the Exchange Online endpoint for mailbox cmdlets, whereas the `*-ComplianceSearch` cmdlets target the Security & Compliance service reached via Connect-IPPSSession; **Search-UnifiedAuditLog** is for audit-log queries, not for identifying message content. The 22-vote highly-voted answer, several corroborating comments, and MS Learn all agree, so confidence is high; it is held at 90% (not higher) only because a 5-vote comment pushes Connect-ExchangeOnline, but that view is clearly outweighed by the documentation.

More SC-200 practice questions