I85PREP
⌘ K
CC-CEM study materials
CC-CEM study resources

CC-CEM: Logging, Monitoring, Incident Response and Forensics

CC-CEM · Work through your exam, one topic at a time.

All guide sections

Logging, Monitoring, Incident Response and Forensics

This domain tests whether you know which log answers which question and how long it survives. Scenario questions present a suspected compromise and ask what to query, in what order, and what evidence is still available.

Sources and retention

  • Message trace answers delivery questions for recent mail - the interactive window is short (about 10 days in the admin centre), with historical search extending further (up to 90 days).
  • Unified audit log records mailbox, admin, and file activity; retention varies by licence - roughly 180 days by default, one year with the higher compliance tier, up to ten years with the retention add-on.
  • Mailbox auditing is on by default for mailboxes in current tenants; the interesting operations are Send, SendAs, Create inbox rule, HardDelete, and UpdateInboxRules.
  • Sign-in logs keep 7 days on the free tier and 30 days with the premium tiers; export to a SIEM for anything longer.
  • Transport and connector logs, DMARC aggregate reports, and alerts round out the picture.

Incident response sequence

  1. Contain: disable the account, revoke refresh tokens and sessions, remove malicious inbox rules, block the sender or domain.
  2. Scope: audit-log search for the account, message trace for outbound to external domains, sign-in logs from unusual locations.
  3. Eradicate: content search and targeted purge of delivered phishing, password reset, MFA re-enrolment.
  4. Recover and review: verify no forwarding remains, notify affected recipients, document timeline.

Forensics discipline

Preserve before you purge: export search results to an approved location, record hashes and timestamps, and note that hard delete removes items from the recoverable view. Litigation hold should be applied to custodians early, because it freezes deletion while you investigate.

Worked example

A finance user's mailbox sent 40 invoices overnight. Disable the account and revoke tokens first - the attacker still has a live session. Then audit-search the mailbox for inbox-rule creation and Send events, message-trace outbound to external recipients, identify the rule forwarding to a lookalike domain, remove it, purge the forwarded copies, and reset credentials with MFA re-registration. Reasoning: order matters because containment stops ongoing exfiltration while the longer queries run.

Traps

  • Querying message trace after the retention window has closed.
  • Assuming audit logging is off by default when it is on for mailboxes.
  • Hard-deleting evidence before exporting it.
  • Forgetting that revoking a password does not revoke existing tokens.