Q: 13
DRAG DROP You have a Microsoft 365 E5 subscription that uses Microsoft Exchange Online. You need to identify phishing email messages. Which three cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order. 
Drag & Drop
Discussion
New-ComplianceSearch → Connect-ExchangeOnline → Search-UnifiedAuditLog. Order matters since you have to set up the search, connect Exchange Online, then run the audit log query. Pretty sure that's right, saw similar steps in the official docs and SC-200 labs.
New-ComplianceSearch, then Connect-ExchangeOnline, then Search-UnifiedAuditLog is the sequence. I think that lines up with SC-200 study guides.
Nah, I think Connect-ExchangeOnline should come first since you need to authenticate before starting anything else. So my order would be Connect-ExchangeOnline → New-ComplianceSearch → Search-UnifiedAuditLog. Creating the search before connecting is a common trap here, pretty sure this is right but open to corrections.
Be respectful. No spam.