CHARLOTTESVILLE, Va. — A lawyer for the family of one of the three students killed in this week’s shooting at the University of Virginia questioned on Wednesday whether the university investigated aggressively enough after learning two months ago that the suspect, a fellow student who lived on campus, may have been in possession of a gun.

The lawyer, Michael Haggard, who is representing the family of D’Sean Perry, said, “If there was notice of the student being a threat to the community at the college and it wasn’t acted upon, what were the details of those threats, why wasn’t it acted upon and what were the standards?”

Such questions were also being raised by community members trying to make sense of the attack, in which three students were killed and two wounded after returning from a class field trip. Even some experts who had praised Virginia’s state government for its pioneering role in establishing protocols for recognizing and responding to potential on-campus threats — a role the state took on after the shooting massacre at Virginia Tech in 2007 — were asking if officials at the University of Virginia could have acted with more urgency in assessing whether the student accused of committing Sunday’s attack, Christopher Darnell Jones Jr., posed a risk.

Brian Coy, a spokesman for the university, declined to comment beyond statements that officials had already put out.

University officials had been investigating whether Mr. Jones, a senior, had a gun in the months leading up to the attack, based on a tip they had received in September. But the tipster had not actually seen Mr. Jones with a gun, officials said this week, and the university’s threat assessment team learned that Mr. Jones’s roommate had not seen a gun, either. The investigation did uncover that Mr. Jones had a concealed-weapon conviction in 2021 in another Virginia county.

But the owner of a sporting goods store near Mr. Jones’s hometown, Petersburg, Va., said that Mr. Jones had in fact made multiple attempts to buy guns in recent years, including after being twice rebuffed — for being underage, then for failing a background check because of a pending felony charge. When that charge was reduced to a misdemeanor as part of a plea deal, Mr. Jones was legally clear to buy firearms, and this year bought a rifle and a 9 mm pistol, according to the store owner, Marlon Dance.

On Wednesday morning, Mr. Jones, who turns 23 on Thursday, appeared by video in a brief court hearing, where he was ordered held without bail. From a screen in a corner of a courtroom in the Albemarle General District Court, Mr. Jones said that he planned to hire a lawyer, and stayed quiet as a prosecutor read out a police account of Sunday night’s attack. In the account, the prosecutor said that a witness told the police that Mr. Jones had been “aiming at certain people and was not randomly shooting.”

In addition to Mr. Perry, Devin Chandler and Lavel Davis Jr. were killed in Sunday night’s shooting on a bus that had just returned from a class field trip to see a play in Washington; all three were juniors on the university’s football team. A fourth football player, Michael Hollins, was shot in the back and is currently in the hospital; according to his father, he is expected to make a full recovery. Another student, Marlee Morgan, was also injured in the attack.

Mr. Jones, who was also on the trip, has been charged with three counts of second-degree murder, two counts of malicious wounding and five counts of using a handgun in the commission of a felony. He agreed to be represented by a public defender while he sought his own lawyer, and the judge set a new hearing for Dec. 8.

Out of its own past tragedies, Virginia became a national leader in formalizing systems to detect and respond to threats on college campuses. After the mass shooting at Virginia Tech, when a student killed 32 people before taking his own life, Virginia became the first state to mandate threat assessment teams in any educational settings, said Gene Deisinger, the threat management consultant for the Virginia Center for School and Campus Safety, part of the state criminal justice agency.

Even today, Mr. Deisinger said, while many states require threat assessment teams in K-12 settings, Virginia is one of only a few states that legally require such teams in institutions of higher education as well.

The teams may follow different protocols on different campuses, but the core model, and the model at the University of Virginia, is a multidisciplinary task force with representatives from a variety of departments, including student affairs, counseling services and campus police. The members of such teams meet regularly to share information about students who may present concerns, while representatives of the various departments that make up the team may take the lead on investigating or intervening.

In Mr. Jones’s case, there appeared to be a number of potential concerns, some of which university officials learned about in the past two months, and some of which were apparently unknown until after the shooting.

In recent years, Mr. Jones had drawn several criminal charges, including an arrest in February 2021 for carrying a concealed weapon without a permit. In that case, according to the Chesterfield County Police Department, officers pulled him over because they did not find his vehicle’s registration on file. During that stop, they found that he was carrying a concealed handgun without a permit, a misdemeanor.

The next month, he was charged with a felony for failing to remain at the scene of a car accident. While that charge was pending, Mr. Jones had tried to buy a firearm at Mr. Dance’s store, Dance’s Sporting Goods. It was Mr. Jones’s second attempt to buy a gun at the store — he was turned down the first time, in 2018, because he was underage — and he was again unsuccessful, as the background check turned up his pending felony charge.

Last October, as part of a plea deal, the felony was reduced to a misdemeanor, and Mr. Jones was legally allowed to buy firearms again. He bought two at the store this year: a 5.56 caliber rifle in February, and a 9 mm pistol in July.

In September, during an investigation by the university’s Department of Student Affairs into a hazing incident on campus, a student told officials that he had heard Mr. Jones make a comment about having a gun, which would be prohibited on campus.

While investigating the tip about the gun, which was never substantiated, officials discovered Mr. Jones’s 2021 conviction on the concealed weapon charge; he had not reported it to the university, a violation of campus policy. Mr. Coy, the spokesman, said that on Oct. 26, after Mr. Jones “repeatedly refused to cooperate” with officials looking into these matters, a representative for student affairs sent Mr. Jones an email warning him that his failure to report the conviction would be referred to the judicial council, the student-run body that handles discipline on campus.

However, for reasons that remain unclear, that referral was never made.

Dr. Jeffrey W. Swanson, a medical sociologist at Duke University who researches gun violence prevention, said it can be challenging for schools to determine who is a serious threat.

“It is difficult for universities, once something has been identified as a threat, to decide how serious it is and whether it reaches a threshold of intervention,” he said, “particularly one that will have serious consequences,” like a criminal referral or dismissal from school.

But to some experts on managing campus risk, there were several signs that the process appeared to have broken down.

“This is the perspective that seems to be a little typical for universities: ‘Our students are adults and we can’t compel them to do anything’ — and I just disagree with that,” said Lori Haas, a longtime gun safety advocate in Virginia who worked to pass the state’s threat assessment legislation after her daughter was injured in the Virginia Tech attack. “Why the hell do you have a student conduct code if you’re not going to enforce it?”

Daniel Victor and Kris Rhim contributed reporting.