You deploy Office 365. All the members of a team named Sales h

ave full access to a shared mailbox named Sales. You enable auditing for all shared mailboxes. From the Sales mailbox, an email message that contains inappropriate content is sent. You need to identify which user sent the message. What should you do?

A.

From the Exchange Control Panel, run an administrator role group report.

B. From Windows PowerShell, run the

Get-SharingPolicy

cmdlet.

C. From Windows PowerShell, run the

Write-AdminAuditLog

cmdlet.

D. From Windows PowerShell, run the

New-MailboxAuditLogSe

arch

cmdlet.

Explanation:

The cmdlet New-MailboxAuditLogSearch is used to search in auditlogs.

Incorrect Answers:

B: The Get-SharingPolicy cmdlet allows you to view the settings of sharing policies. Sharing policies allow for user-established,

people-to-people sharing of calendar information with different types of external users. To identify which user sent the message, you should view the sharing policies to reveal the relevant mailbox.

References: https://technet.microsoft.com/en-us/library/

ff522362(v=exchg.150).aspx