Microsoft Role-based MS-500 Questions & Answers

• Question 1:

  You need to implement Windows Defender ATP to meet the security requirements. What should you do?

  A. Configure port mirroring

  B. Create the ForceDefenderPassiveMode registry setting

  C. Download and install the Microsoft Monitoring Agent

  D. Run WindowsDefenderATPOnboardingScript.cmd

  Correct Answer: C

• Question 2:

  An administrator configures Azure AD Privileged Identity Management as shown in the following exhibit.

  

  What should you do to meet the security requirements?

  A. Change the Assignment Type for Admin2 to Permanent

  B. From the Azure Active Directory admin center, assign the Exchange administrator role to Admin2

  C. From the Azure Active Directory admin center, remove the Exchange administrator role to Admin1

  D. Change the Assignment Type for Admin1 to Eligible

  Correct Answer: D

  Should change Admin1 to elegible.

  "Users who manage Microsoft 365 workloads must only be allowed to perform administrative tasks for up to three hours at a time. Global administrators must be exempt from this requirement" ...as they are EXO admins, they shouldn't be

  permanent.

• Question 3:

  You need to create Group2.

  What are two possible ways to create the group?

  A. an Office 365 group in the Microsoft 365 admin center

  B. a mail-enabled security group in the Microsoft 365 admin center

  C. a security group in the Microsoft 365 admin center

  D. a distribution list in the Microsoft 365 admin center

  E. a security group in the Azure AD admin center

  Correct Answer: CE

• Question 4:

  You need to create Group3

  What are two possible ways to create the group?

  A. a Microsoft 365 group in the Microsoft 365 admin center

  B. a mail-enabled security group in the Microsoft 365 admin center

  C. a security group in the Microsoft 365 admin center

  D. a distribution group in the Microsoft 365 admin center

  E. a security group in the Azure AD admin center

  Correct Answer: AD

• Question 5:

  Which IP address space should you include in the Trusted IP MFA configuration?

  A. 131.107.83.0/28

  B. 192.168.16.0/20

  C. 172.16.0.0/24

  D. 192.168.0.0/20

  Correct Answer: A

  Pilot users must use MFA unless they are signing in from the internal network of the Chicago office. MFA must NOT be used on the Chicago office internal network. We must therefore use the IP range of the external network.

• Question 6:

  You need to enable and configure Microsoft Defender for Endpoint to meet the security requirements. What should you do?

  A. Configure port mirroring

  B. Create the ForceDefenderPassiveMode registry setting

  C. Download and install the Microsoft Monitoring Agent

  D. Run WindowsDefenderATPOnboardingScripc.cmd

  Correct Answer: D

  You need to enable and configure Microsoft Defender for Endpoint to meet the security requirements. What should you do?

  -Windows server 2016, which means you can do it via GPO, via script or via packages. In this case, the only option available is the script. See documentation below that proves it.

  EXAMPLE: .\install.ps1 -RemoveMMA -OnboardingScript ".\WindowsDefenderATPOnboardingScript.cmd"

  https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/server-migration?view=o365-worldwide#installer-script

• Question 7:

  Which role should you assign to User1?

  A. Global administrator

  B. User administrator

  C. Privileged role administrator

  D. Security administrator

  Correct Answer: C

  This role grants the ability to manage assignments for all Azure AD roles including the Global Administrator role. This role does not include any other privileged abilities in Azure AD like creating or updating users. However, users assigned to this role can grant themselves or others additional privilege by assigning additional roles. https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-give-access

• Question 8:

  Which user passwords will User2 be prevented from resetting?

  A. User6 and User7

  B. User4 and User6

  C. User4 only

  D. User7 and User8

  E. User8 only

  Correct Answer: E

  Assign the Password admin role to a user who needs to reset passwords for non-administrators and Password Administrators.

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide

• Question 9:

  What should User6 use to meet the technical requirements?

  A. Supervision in the Security and Compliance admin center

  B. Service requests in the Microsoft 365 admin center

  C. Security and privacy in the Microsoft 365 admin center

  D. Data subject requests in the Security and Compliance admin center

  Correct Answer: B

  https://learn.microsoft.com/en-us/microsoft-365/compliance/customer-lockbox-requests?view=o365-worldwide

• Question 10:

  You need to meet the technical requirements for User9. What should you do?

  A. Assign the Privileged administrator role to User9 and configure a mobile phone number for User9

  B. Assign the Compliance administrator role to User9 and configure a mobile phone number for User9

  C. Assign the Security administrator role to User9

  D. Assign the Global administrator role to User9

  Correct Answer: A

  https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started

  When a user who is active in a privileged role in an Azure AD organization with a Premium P2 license goes to Roles and administrators in Azure AD and selects a role (or even just visits Privileged Identity Management):

  We automatically enable PIM for the organization Their experience is now that they can either assign a "regular" role assignment or an eligible role assignment When PIM is enabled it doesn't have any other effect on your organization that you need to worry about. It gives you additional assignment options such as active vs eligible with start and end time. PIM also enables you to define scope for role assignments using Administrative Units and custom roles. If you are a Global Administrator or Privileged Role Administrator, you might start getting a few additional emails like the PIM weekly digest. You might also see MS-PIM service principal in the audit log related to role assignment. This is an expected change that should have no effect on your workflow.