Microsoft Microsoft Certifications MS-500 Questions & Answers

• Question 201:

  You have a Microsoft 365 subscription.

  Yesterday, you created retention labels and published the labels to Microsoft Exchange Online mailboxes.

  You need to ensure that the labels will be available for manual assignment as soon as possible.

  What should you do?

  A. From the Security and Compliance admin center, create a label policy

  B. From Exchange Online PowerShell, run Start-RetentionAutoTagLearning

  C. From Exchange Online PowerShell, run Start-ManagedFolderAssistant

  D. From the Security and Compliance admin center, create a data loss prevention (DLP) policy

  Correct Answer: C

• Question 202:

  Your company has a Microsoft 365 subscription that includes a user named User1.

  You suspect that User1 sent email messages to a competitor detailing company secrets.

  You need to recommend a solution to ensure that you can review any email messages sent by User1 to the competitor, including sent items that were deleted.

  What should you include in the recommendation?

  A. Enable In-Place Archiving for the mailbox of User1

  B. From the Security and Compliance, perform a content search of the mailbox of User1

  C. Place a Litigation Hold on the mailbox of User1

  D. Configure message delivery restrictions for the mailbox of User1

  Correct Answer: C

  A Litigation Hold is a feature that allows you to preserve all mailbox data, including deleted items, for a specified period of time. This means that if User1 deleted any email messages sent to the competitor, they will still be preserved and available for review.

• Question 203:

  You have a hybrid Microsoft 365 environment.

  All computers run Windows 10 Enterprise and have Microsoft Office 365 ProPlus installed. All the computers are joined to Active Directory.

  You have a server named Server1 that runs Windows Server 2016. Server1 hosts the telemetry database. You need to prevent private details in the telemetry data from being transmitted to Microsoft.

  What should you do?

  A. On Server1, run readinessreportcreator.exe

  B. Configure a registry entry on Server1

  C. Configure a registry entry on the computers

  D. On the computers, run tdadm.exe

  Correct Answer: C

  "To allow yourself and other administrators to identify the owners of Office files that have compatibility issues without revealing file names or specific locations, you can enable file obfuscation, which disguises Office file names, titles, and file paths. This setting is configured on the agent, which performs the obfuscation task before uploading data to the shared folder. The data that is stored on the local computer is not obfuscated." https://docs.microsoft.com/enus/deployoffice/compat/manage-the-privacy-of-data-monitored-by-telemetry-in-office

• Question 204:

  You have a Microsoft 365 subscription that includes a user named Admin1.

  You need to ensure that Admin1 can preserve all the mailbox content of users, including their deleted items.

  The solution must use the principle of least privilege.

  What should you do?

  A. From the Microsoft 365 admin center, assign the Exchange administrator role to Admin1.

  B. From the Exchange admin center, assign the Discovery Management admin role to Admin1.

  C. From the Azure Active Directory admin center, assign the Service administrator role to Admin1.

  D. From the Exchange admin center, assign the Recipient Management admin role to Admin1.

  Correct Answer: A

  https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels#what-label-policiescan-do

• Question 205:

  You create a label that encrypts email data. Users report that they cannot use the label in Outlook on the web to protect the email messages they send.

  You need to ensure that the users can use the new label to protect their email.

  What should you do?

  A. Modify the priority order of label policies

  B. Wait six hours and ask the users to try again

  C. Create a label policy

  D. Create a new sensitive information type

  Correct Answer: C

  Admin has to publish labels by creating label policy.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels#what-label-policies-can-do

• Question 206:

  You have a Microsoft 365 subscription.

  All computers run Windows 10 Enterprise and are managed by using Microsoft Intune.

  You plan to view only security-related Windows telemetry data.

  You need to ensure that only Windows security data is sent to Microsoft.

  What should you create from the Intune admin center?

  A. a device configuration profile that has device restrictions configured

  B. a device configuration profile that has the Endpoint Protection settings configured

  C. a device compliance policy that has the System Security settings configured

  D. a device compliance policy that has the Device Health settings configured

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#reporting-and-telemetry

• Question 207:

  You have a Microsoft 365 subscription.

  You need to enable auditing for all Microsoft Exchange Online users.

  What should you do?

  A. From the Exchange admin center, create a journal rule

  B. Run the Set-MailboxDatabase cmdlet

  C. Run the Set-Mailbox cmdlet

  D. From the Exchange admin center, create a mail flow message trace rule.

  Correct Answer: C

  As previously explained, one of the key benefits of having mailbox auditing on by default is: you don't need to manage the mailboxes actions that are audited. Microsoft does this for you and we'll automatically add new mailbox actions to be audited by default as they're released.

  However, your organization might be required to audit a different set of mailbox actions for user mailboxes and shared mailboxes.

  Change the mailbox actions to audit You can use the AuditAdmin, AuditDelegate, or AuditOwner parameters on the Set-Mailbox cmdlet to change the mailbox actions that are audited for user mailboxes and shared mailboxes (audited actions for Microsoft 365 group mailboxes can't be customized).

  Reference: https://docs.microsoft.com/en-us/office365/securitycompliance/enable-mailbox-auditing

• Question 208:

  You have a Microsoft 365 E5 subscription without a Microsoft Azure subscription.

  Some users are required to use an authenticator app to access Microsoft SharePoint Online.

  You need to view which users have used an authenticator app to access SharePoint Online. The solution must minimize costs.

  What should you do?

  A. From the Security and Compliance admin center, download a report.

  B. From Azure Log Analytics, query the logs.

  C. From the Azure Active Directory admin center, view the audit logs.

  D. From the Enterprise applications blade of the Azure Active Directory admin center, view the sign-ins.

  Correct Answer: D

  The user sign-ins report provides information on the sign-in pattern of a user, the number of users that have signed in over a week, and the status of these sign- ins.

  Note:

  There are several versions of this question in the exam. The question has two possible correct answers:

  1.

  From the Enterprise applications blade of the Azure Active Directory admin center, view the sign-ins.

  2.

  From the Azure Active Directory admin center, view the sign-ins.

  Other incorrect answer options you may see on the exam include the following:

  1.

  From the Enterprise applications blade of the Azure Active Directory admin center, view the audit logs.

  2.

  From the Azure Active Directory admin center, view the audit logs.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins

• Question 209:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some questions sets might have more than one correct solution,

  while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an on-premises Active Directory domain named contoso.com.

  You install and run Azure AD Connect on a server named Server1 that runs Windows Server.

  You need to view Azure AD Connect events.

  Solution: You use the Application event log on Server1.

  Does that meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  References: https://support.pingidentity.com/s/article/PingOne-How-to-troubleshoot-an-AD-Connect-Instance

• Question 210:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some questions sets might have more than one correct solution,

  while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an on-premises Active Directory domain named contoso.com.

  You install and run Azure AD Connect on a server named Server1 that runs Windows Server.

  You need to view Azure AD Connect events.

  Solution: You use the Directory Service event log on Server1.

  Does that meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  References: https://support.pingidentity.com/s/article/PingOne-How-to-troubleshoot-an-AD-Connect-Instance