SC-200 Certification Practice Question #247

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Exchange Online.

You identify the suspicious emails shown in the following table.

In Microsoft Purview, you create the content searches shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

The decisive nuance is Search2's `-subjecttitle=benefits`. In Microsoft Purview Content search / eDiscovery KeyQL, a leading hyphen is the NOT operator, so the clause requires the subject to NOT contain "benefits". Email2's subject ("Update your benefits in the Contoso HR portal") does contain "benefits", so it is excluded → No. Search1 requires both a docx file type and the sender prizes@contoso.com, which Email1 satisfies → Yes. Search3 requires the sender benefits@contoso.com and the subject to contain "won"; KeyQL is case-insensitive so "WON" matches → Yes. This Y N Y matches the dominant Highly Voted comments (27 and 6 👍) and is confirmed by the documented behavior of the supported email properties and the exclusion operator. Confidence is held at 88 rather than higher because the file shows no official Suggested Answer and there are some low-vote dissents.

More SC-200 practice questions