Microsoft Microsoft Certifications MS-500 Questions & Answers

• Question 111:

  You have a hybrid Microsoft 365 deployment that contains the Windows 10 devices shown in the following table.

  

  You assign a Microsoft Endpoint Manager disk encryption policy that automatically and silently enables BitLocker Drive Encryption (BitLocker) on all the devices. Which devices will have BitLocker enabled?

  A. Device1, Device2, and Device3

  B. Device2 only

  C. Device1 and Device2 only

  D. Device2 and Device3 only

  Correct Answer: D

  "The device must also be Azure AD joined or hybrid Azure AD joined. The device must also contain at least TPM version 1.2 or the Trusted Platform Module." Reference: https://cloudacademy.com/course/microsoft-365-device-application-protection-2923/configuring-and-managing-windows-device-encryption/

• Question 112:

  You have a Microsoft 365 subscription that contains the users shown in the following table.

  

  You enable self-service password reset for Group1 and configure security questions as the only authentication method for self-service password reset.

  You need to identity which user must answer security questions to reset their password.

  Which user should you identify?

  A. User1

  B. User2

  C. User3

  D. User4

  Correct Answer: B

  Self-service password reset (SSPR) is only enabled for Group1 (User1 and User2). User1 cannot use security questions for SSPR because User1 has an administrative security role. Therefore, only User2 can use SSPR with security questions as the authentication method.

  References: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences

• Question 113:

  You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

  

  You need to ensure that User1, User2, and User3 can use self-service password reset (SSPR). The solution must not affect User4.

  Solution: You enable SSPR for Group1.

  Does that meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  By default, self-service password reset is enabled for Directory writers and Security administrator but not for Azure Information Protection administrators and Cloud application administrators. Thus, we must enable SSPR for User3 by applying it to Group2.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences

• Question 114:

  You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

  

  You need to ensure that User1, User2, and User3 can use self-service password reset (SSPR). The solution must not affect User4.

  Solution: You enable SSPR for Group2.

  Does that meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  By default, self-service password reset is enabled for Directory writers and Security administrator but not for Azure Information Protection administrators and Cloud application administrators.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences

• Question 115:

  You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

  

  You need to ensure that User1, User2, and User3 can use self-service password reset (SSPR). The solution must not affect User4.

  Solution: You enable SSPR for Group3.

  Does that meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  By default, self-service password reset is enabled for Directory writers and Security administrator but not for Azure Information Protection administrators and Cloud application administrators. Therefore, we must enable SSPR for User3 by applying it to Group2 and not Group3 as User4 is in Group3. User4 would thus be affected if we enable it on Group3.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences

• Question 116:

  You have a Microsoft 365 E5 subscription.

  You plan to create a conditional access policy named Policy1.

  You need to be able to use the sign-in risk level condition in Policy1.

  What should you do first?

  A. Connect Microsoft Endpoint Manager and Microsoft Defender for Endpoint.

  B. From the Azure Active Directory admin center, configure the Diagnostics settings.

  C. From the Endpoint Management admin center, create a device compliance policy.

  D. Onboard Azure Active Directory (Azure AD) Identity Protection.

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-risk

• Question 117:

  You have a Microsoft 365 tenant.

  From the Azure Active Directory admin center, you review the Risky sign-ins report as shown in the following exhibit.

  

  You need to ensure that you can see additional details including the risk level and the risk detection type. What should you do?

  A. Purchase Microsoft 365 Enterprise E5 licenses.

  B. Activate an instance of Microsoft Defender for Identity.

  C. Configure Diagnostic settings in Azure Active Directory (Azure AD).

  D. Deploy Azure Sentinel and add a Microsoft Office 365 connector.

  Correct Answer: A

• Question 118:

  You have a Microsoft 365 E3 subscription.

  You plan to audit all Microsoft Exchange Online user and admin activities.

  You need to ensure that all the Exchange audit log records are retained for one year.

  What should you do?

  A. Modify the retention period of the default audit retention policy.

  B. Create a custom audit retention policy.

  C. Assign Microsoft 365 Enterprise E5 licenses to all users.

  D. Modify the record type of the default audit retention policy.

  Correct Answer: C

  Microsoft 365 Enterprise E5 license audit log record retention is 365 days. Microsoft 365 Enterprise E3 license audit log record retention is 90 days.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/audit-log-retention-policies?view=o365-worldwide

• Question 119:

  You have a Microsoft 365 tenant.

  You have a database that stores customer details. Each customer has a unique 13-digit identifier that consists of a fixed pattern of numbers and letters. You need to implement a data loss prevention (DLP) solution that meets the following requirements:

  1.

  Email messages that contain a single customer identifier can be sent outside your company.

  2.

  Email messages that contain two or more customer identifiers must be approved by the company's data privacy team. Which two components should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  A. a sensitive information type

  B. a sensitivity label

  C. a retention label

  D. a DLP policy

  E. a mail flow rule

  Correct Answer: AD

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitive-information-type-entity-definitions?view=o365-worldwide

• Question 120:

  You have several Conditional Access policies that block noncompliant devices from connecting to services.

  You need to identity which devices are blocked by which policies.

  What should you use?

  A. the Setting compliance report in the Microsoft Endpoint Manager admin center

  B. Sign-ins in the Azure Active Directory admin center

  C. Activity log in the Cloud App Security admin center

  D. Audit logs in the Azure Active Directory admin center

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/troubleshoot-conditional-access