Microsoft Microsoft Certifications MS-500 Questions & Answers

• Question 11:

  You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Office 365.

  You need to protect users from malicious emails that attempt to capture their credentials.

  The solution must ensure that suspicious emails contain tips alerting the users to potential threats.

  What should you create?

  A. a Safe Links policy

  B. an anti-phishing policy

  C. an alert policy for delivered phishing email

  D. an alert policy for suspicious email

  Correct Answer: B

• Question 12:

  You have a Microsoft 365 ES subscription that contains a Microsoft SharePoint Online site named Site1. You create an information barrier segment named Segment 1. You need to add Segment 1 to Site1. What should you do first?

  A. Run the set-spositr cmcHet.

  B. Run the set-sPOTenont cmdlet.

  C. Create an information barrier policy.

  D. Modify the permissions of Site1.

  Correct Answer: C

• Question 13:

  You have a Microsoft 365 E5 subscription that uses Privacy Risk Management in Microsoft Priva.

  You need to review the personal data type instances that were detected in the subscription.

  What should you use in the Microsoft Purview compliance portal?

  A. Content search

  B. an eDiscovery case

  C. Content explorer

  D. User data search

  Correct Answer: C

• Question 14:

  You have a Microsoft 365 E5 subscription that contains a user named User1.

  You need to ensure that User1 can configure an Azure Active Directory (Azure AD) Identity Protection user risk policy and receive Azure AD Identity Protection alerts. The solution must use the principle of least privilege.

  Which role should you assign to User1?

  A. Security Operator

  B. Identity Governance Administrator

  C. Security Administrator

  D. Security Reader

  Correct Answer: C

  Only Global Admins and Security Admins can configure Identity Protection policies. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection#required-roles

• Question 15:

  You have a Microsoft 365 E5 subscription that contains a user named User1. You need to ensure that User1 can review Conditional Access policies.

  Solution: You assign User1 the Security Administrator role.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

• Question 16:

  You have a Microsoft 365 E5 subscription.

  You need to investigate threats to the subscription by using the Campaigns view in Microsoft Defender for Office 365.

  Which types of threats will appear?

  A. phishing and password attacks only

  B. malware and password attacks only

  C. malware only

  D. phishing only

  E. phishing and malware only

  Correct Answer: E

  According to the article “Campaigns in Microsoft Defender for Office 365 Plan” 1, campaigns in the Microsoft 365 Defender portal identifies and categorizes coordinated email attacks, including phishing and malware 1. The article “Track and respond to emerging threats with campaigns in Microsoft Defender for Office 365” 2 also confirms that campaigns allow you to investigate a coordinated email attack against your organization that involves phishing and malware 2. The article “Microsoft Defender for Office 365 service description” 3 lists the features of Defender for Office 365 Plan 2, which include anti-phishing and anti-malware protection 3. Password attacks are not mentioned as a type of threat that will appear in the Campaigns view.

• Question 17:

  You have a Microsoft 365 E5 subscription.

  A customer requests access to all his personal data.

  You need to manage the customer's request.

  What should you do first?

  A. Create a content search.

  B. Enable sharing with external users.

  C. Set Require approval for all data access requests to On for Customer Lockbox.

  D. Create a Data Subject Request (DSR) case.

  Correct Answer: D

• Question 18:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your on-premises network contains a server that runs Windows Server 2019, computers that run Windows 10, macOS, or Linux, and a firewall that utilizes syslog.

  You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. All the computers are onboarded to Microsoft Defender for Endpoint.

  You are implementing Microsoft Defender for Cloud Apps.

  You need to discover which cloud apps are accessed from the computers.

  Solution: You enable Defender for Endpoint and Defender for Cloud Apps integration.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead: Install a Microsoft Defender for Identity sensor on the server.

  Note: Microsoft Defender for Identity monitors your domain controllers by capturing and parsing network traffic and leveraging Windows events directly from your domain controllers, then analyzes the data for attacks and threats.

  Reference:

  https://docs.microsoft.com/en-us/defender-for-identity/architecture

• Question 19:

  You configure several Microsoft Defender for Office 365 policies in a Microsoft 365 subscription.

  You need to allow a user named User1 to view Microsoft Defender for Office 365 reports in the Threat management dashboard.

  Which role provides User1 with the required role permissions?

  A. Security reader

  B. Compliance administrator

  C. Information Protection administrator

  D. Exchange administrator

  Correct Answer: A

  In order to view and use the reports described in this article, you need to be a member of one of the following role groups in the Microsoft 365 Defender portal: Organization Management Security Administrator Security Reader Global Reader Note: There are several versions of this question in the exam. The question has two possible correct answers:

  1.

  Security Administrator

  2.

  Security Reader Other incorrect answer options you may see on the exam include the following: Message center reader Service administrator Reference: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/view-reports-for-mdo

• Question 20:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your on-premises network contains a server that runs Windows Server 2019, computers that run Windows 10, macOS, or Linux, and a firewall that utilizes syslog.

  You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. All the computers are onboarded to Microsoft Defender for Endpoint.

  You are implementing Microsoft Defender for Cloud Apps.

  You need to discover which cloud apps are accessed from the computers.

  Solution: You install a Microsoft Defender for Cloud Apps log collector and collect logs from the firewall.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  https://www.youtube.com/watch?v=MsHkTOoqSQo