Microsoft Microsoft Certifications MS-500 Questions & Answers

• Question 141:

  You have a Microsoft 365 subscription and a Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) subscription.

  

  You have devices enrolled in Microsoft Endpoint Manager as shown in the following table:

  You integrate Microsoft Defender ATP and Endpoint Manager.

  You plan to evaluate the Microsoft Defender ATP risk level for the devices.

  You need to identify which devices can be evaluated.

  Which devices should you identify?

  A. Device1 and Device2 only

  B. Device1 only

  C. Device1 and Device3 only

  D. Device1, Device2 and Device3

  Correct Answer: D

  Microsoft Defender ATP (now known as Microsoft Defender for Endpoint) now supports Windows 7 SP1 and above, Windows Server 2008 SP1 and above, the three most recent major releases of macOS, iOS 11.0 and above, Android 6.0

  and above and Red Hat Enterprise Linux 7.2 or higher, CentOS 7.2 or higher,

  Ubuntu 16.04 LTS or higher LTS, Debian 9 or higher, SUSE Linux Enterprise Server 12 or higher, and Oracle Linux 7.2 or higher.

  Reference:

  https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements

• Question 142:

  You configure several Advanced Threat Protection (ATP) policies in a Microsoft 365 subscription. You need to allow a user named User1 to view ATP reports in the Threat management dashboard. Which role provides User1 with the required role permissions?

  A. Security reader

  B. Exchange administrator

  C. Compliance administrator

  D. Message center reader

  Correct Answer: A

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/view-reports-for-atp?view=o365-worldwide#what-permissions-are-needed-to-view-the- atp-reports

• Question 143:

  You have a Microsoft 365 subscription.

  Your company uses Jamf Pro to manage macOS devices.

  You plan to create device compliance policies for the macOS devices based on the Jamf Pro data.

  You need to connect Microsoft Endpoint Manager to Jamf Pro.

  What should you do first?

  A. From the Azure Active Directory admin center, add a Mobility (MDM and MAM) application.

  B. From the Endpoint Management admin center, add the Mobile Threat Defense connector.

  C. From the Endpoint Management admin center, configure Partner device management.

  D. From the Azure Active Directory admin center, register an application.

  Correct Answer: D

  Connect Intune to Jamf Pro (To connect Intune with Jamf Pro steps are):

  1.

  Create a new application in Azure. (In the Azure portal, go to Azure Active Directory > App Registrations, and then select New registration.)

  2.

  Enable Intune to integrate with Jamf Pro. (From MEM admin center, Select Tenant administration > Connectors and tokens > Partner device management... Enable the Compliance Connector for Jamf by pasting the Application ID you

  saved during the previous procedure into the Specify the Azure Active Directory App ID for Jamf field).

  3.

  Configure Conditional Access in Jamf Pro.

  Step a. Activate the connection in the Jamf Pro console: Open the Jamf Pro console and navigate to Global Management > Conditional Access. Click the Edit button on the macOS Intune Integration tab.

  Step b. In Intune, go to the Partner device management page. Under Connector Settings configure groups for assignment

  Reference:

  https://docs.microsoft.com/en-us/mem/intune/protect/conditional-access-integrate-jamf

• Question 144:

  You have a hybrid deployment of Microsoft 365 that contains the users shown in the following table.

  

  You plan to use Microsoft 365 Attack Simulator.

  You need to identify the users against which you can use Attack Simulator.

  Which users should you identify?

  A. User1 and User3 only

  B. User1, User2, User3, and User4

  C. User3 only

  D. User3 and User4 only

  Correct Answer: D

  Each targeted recipient must have an Exchange Online mailbox.

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attacksimulator?view=o365-worldwide

• Question 145:

  You have a Microsoft 365 E5 subscription and 5,000 users.

  You create several alert policies that are triggered every time activities match rules.

  You need to create an alert policy that is triggered when the volume of matched activities becomes unusual.

  What should you do first?

  A. Enable Microsoft Office 365 auditing.

  B. Enable Microsoft Office 365 analytics.

  C. Enable Microsoft Office 365 Cloud App Security.

  D. Deploy a Microsoft Office 365 add-in to all the users.

  Correct Answer: B

• Question 146:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a Microsoft 365 subscription that contains 1,000 user mailboxes.

  An administrator named Admin1 must be able to search for the name of a competing company in the mailbox of a user named User5.

  You need to ensure that Admin1 can search the mailbox of User5 successfully. The solution must prevent Admin1 from sending email messages as User5.

  Solution: You modify the privacy profile, and then create a Data Subject Request (DSR) case.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 147:

  You have a Microsoft 365 subscription that contains the users shown in the following table.

  

  You enable self-service password reset for Group1 and configure security questions as the only authentication method for self-service password reset. You need to identify which user

  A. User1

  B. User2

  C. User3

  D. User4

  Correct Answer: C

• Question 148:

  An administrator plans to deploy several Azure Advanced Threat Protection (ATP) sensors.

  You need to provide the administrator with the Azure information required to deploy the sensors.

  What information should you provide?

  A. an Azure Active Directory Authentication Library (ADAL) token

  B. the public key

  C. the access key

  D. the URL of the Azure ATP admin center

  Correct Answer: C

  According to the newest Microsoft documentation the sensor download and key are on the Identities part of the Microsoft 365 Defender portal.

  Reference: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/workspace-portal

• Question 149:

  Your network contains an on-premises Active Directory domain. The domain contains the servers shown in the following table.

  

  You plan to implement Azure Advanced Threat Protection (ATP) for the domain.

  You install an Azure ATP standalone sensor on Server1.

  You need to monitor the domain by using Azure ATP.

  What should you do?

  A. Configure port mirroring for Server1.

  B. Install the Microsoft Monitoring Agent on DC1.

  C. Install the Microsoft Monitoring Agent on Server1.

  D. Configure port mirroring for DC1.

  Correct Answer: D

  Taken from: https://learn.microsoft.com/en-us/defender-for-identity/prerequisites

  "The Defender for Identity standalone sensor is installed on a dedicated server and requires port mirroring to be configured on the domain controller to receive network traffic."

  Reference:

  https://docs.microsoft.com/en-us/azure-advanced-threat-protection/configure-port-mirroring

• Question 150:

  A user stores the following files in Microsoft OneDrive:

  1.

  File.docx

  2.

  ImportantFile.docx

  3.

  File_Important.docx

  You create a Microsoft Cloud App Security file policy Policy1 that has the filter shown in the following exhibit.

  

  To which files does Policy1 apply?

  A. File_Important.docx only

  B. File.docx, ImportantFile.docx, and File_Important.docx

  C. File.docx only

  D. ImportantFile.docx only

  E. File.docx and File_Important.docx only

  Correct Answer: B

  When using the file policy filters, Contains will search only for full words – separated by commas, dots, hyphens or spaces to search.

  Spaces or hyphens between words function like OR. For example, if you search for malware virus it will find all files with either malware or virus in the name, so it will find both malware-virus.exe and virus.exe.

  If you want to search for a string, enclose the words in quotation marks. This functions like AND. For example, if you search for "malware" "virus", it will find virus_malware_file.exe but it will not find malwarevirusfile.exe and it will not find

  malware.exe. However, it will search for the exact string. If you search for "malware virus", it will not find "virus" or "virus_malware".

  Reference:

  https://docs.microsoft.com/en-us/cloud-app-security/file-filters