Microsoft Microsoft Certifications MS-500 Questions & Answers

• Question 231:

  You need to ensure that group owners renew their Office 365 groups every 180 days.

  To complete this task, sign in to the Microsoft Office 365 admin center.

  Correct Answer: See explanation below.

  Set group expiration

  1.

  Open the Azure AD admin center with an account that is a global administrator in your Azure AD organization.

  2.

  Select Groups, then select Expiration to open the expiration settings.

  3.

  On the Expiration page, you can:

  Set the group lifetime in days. You could select one of the preset values, or a custom value (should be 31 days or more).

  Specify an email address where the renewal and expiration notifications should be sent when a group has no owner.

  Select which Office 365 groups expire. You can set expiration for:

  All Office 365 groups

  A list of Selected Office 365 groups

  None to restrict expiration for all groups

  

  Save your settings when you're done by selecting Save.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-lifecycle

• Question 232:

  You need to ensure that when users tag documents as classified, a classified watermark is applied to the documents.

  To complete this task, sign in to the Microsoft Office 365 admin center.

  Correct Answer: See explanation below.

  1.

  In the admin center, select the Compliance admin center.

  2.

  Select Classification > Sensitivity labels.

  3.

  Select Create a label, and when the warning appears, select Yes.

  4.

  Enter a Label name, Tooltip, and Description. Select Next.

  5.

  Turn on Encryption. Choose when you want to assign permissions, whether you want your users' access to the content to expire, and whether you want to allow offline access.

  6.

  Select Assign permissions > Add these email addresses or domains.

  7.

  Enter an email address or domain name (such as Contoso.org). Select Add, and repeat for each email address or domain you want to add.

  8.

  Select Choose permissions from preset or custom.

  9.

  Use the drop-down list to select preset permissions, such as Reviewer or Viewer, or select Custom permissions. If you chose Custom, select the permissions from the list. Select Save >Save > Next.

  10.

  Turn on Content marking, and choose the markings you want to use.

  11.

  For each marking that you choose, select Customize text. Enter the text you want to appear on the document, and set the font and layout options. Select Save, and then repeat for any additional markings. Select Next.

  12.

  Optionally, turn on Endpoint data loss prevention. Select Next.

  13.

  Optionally, turn on Auto labeling. Add a condition. For example, under Detect content that contains, select Add a condition. Enter the condition; for example, add a condition that if passport, Social Security, or other sensitive information is detected, the label will be added. Select Next.

  14.

  Review your settings, and select Create. Your label has been created. Repeat this process for any additional labels you want.

  15.

  By default, labels appear in Office apps in this order: Confidential, Internal, and Public. To change the order, for each label, select More actions (the ellipsis), and then move the label up or down. Typically, permissions are listed from the lowest to highest level of permissions.

  16.

  To add a sub-label to a label, select More actions, then Add sub level.

  17.

  When finished, choose Publish labels> Choose labels to publish > Add. Select the labels you want to publish, and then select Add > Done > Next.

  18.

  By default, the new label policy is applied to everyone. If you want to limit who the policy is applied to, select Choose users or groups > Add. Select who you want the policy to apply to, and then select Add > Done > Next.

  19.

  If you want a default label for documents and email, select the label you want from the drop-down list. Review the remaining settings, adjust as needed, and then select Next.

  20.

  Enter a Name and Description for your policy. Select Next.

  21.

  Review your settings, then select Publish.

  Reference: https://support.office.com/en-us/article/create-and-manage-sensitivity-labels-2fb96b54-7dd2-4f0c-ac8d-170790d4b8b9 https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide

• Question 233:

  You need to ensure that each user can join up to five devices to Azure Active Directory (Azure AD).

  To complete this task, sign in to the Microsoft Office 365 admin center.

  Correct Answer: See explanation below.

  1.

  After signing into the Microsoft 365 admin center, click Admin centers > Azure Active Directory > Devices.

  2.

  Navigate to Device Settings.

  3.

  Set the Users may join devices to Azure AD setting to All.

  4.

  Set the Additional local administrators on Azure AD joined devices setting to None.

  5.

  Set the Users may register their devices with Azure AD setting to All.

  6.

  Leave the Require Multi-Factor Auth to join devices setting on it default setting.

  7.

  Set the Maximum number of devices setting to 5.

  8.

  Set the Users may sync settings and app data across devices setting to All.

  9.

  Click the Save button at the top left of the screen.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal https://docs.microsoft.com/en-us/microsoft-365/compliance/use-your-free-azure-ad-subscription-in-office-365?view=o365-worldwide

• Question 234:

  You need to ensure that a user named Lee Gu can manage all the settings for Exchange Online. The solution must use the principle of least privilege.

  To complete this task, sign in to the Microsoft Office 365 admin center.

  Correct Answer: See explanation below.

  1.

  In the Exchange Administration Center (EAC), navigate to Permissions > Admin Roles.

  2.

  Select the group: Organization Management and then click on Edit.

  3.

  In the Members section, click on Add.

  4.

  Select the users, USGs, or other role groups you want to add to the role group, click on Add, and then click on OK.

  5.

  Click on Save to save the changes to the role group.

  Reference:

  https://help.bittitan.com/hc/en-us/articles/115008104507-How-do-I-assign-the-elevated-admin-role-Organization-Management-to-the-account-that-is-performing-a-Public-Folder-migration

  https://docs.microsoft.com/en-us/exchange/permissions-exo/permissions-exo

• Question 235:

  You need to ensure that a user named Alex Wilber can register for multifactor authentication (MFA).

  To complete this task, sign in to the Microsoft Office 365 admin center.

  Correct Answer: See explanation below.

  Enable Modern authentication for your organization

  1.

  To enable modern authentication, from the admin center, select Settings > Settings and then in the Services tab, choose Modern authentication from the list.

  2.

  Check the Enable modern authentication box in the Modern authentication panel.

  

  Enable multi-factor authentication for your organization

  1.

  In the admin center, select Users and Active Users.

  2.

  In the Active Users section, Click on multi-factor authentication.

  3.

  On the Multi-factor authentication page, select user if you are enabling this for one user or select Bulk Update to enable multiple users.

  4.

  Click on Enable under Quick Steps.

  5.

  In the Pop-up window, Click on Enable Multi-Factor Authentication.

  After you set up multi-factor authentication for your organization, your users will be required to set up two-step verification on their devices.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide

• Question 236:

  You need to ensure that a global administrator is notified when a document that contains U.S. Health Insurance Portability and Accountability Act (HIPAA) data is identified in your Microsoft 365 tenant.

  To complete this task, sign in to the Microsoft Office 365 admin center.

  Correct Answer: See explanation below.

  1.

  In the Security and Compliance Center > left navigation > Data loss prevention > Policy > + Create a policy.

  2.

  Choose the U.S. Health Insurance Portability and Accountability Act (HIPAA) template > Next.

  3.

  Name the policy > Next.

  4.

  Choose All locations in Office 365 > Next.

  5.

  At the first Policy Settings step just accept the defaults,

  6.

  After clicking Next, you'll be presented with an additional Policy Settings page

  Deselect the Show policy tips to users and send them an email notification option.

  Select the Detect when content that's being shared contains option, and decrease the number of instances to 1.

  Select the Send incident reports in email option.

  7.

  > Next

  8.

  Select the option to turn on the policy right away > Next.

  9.

  Click Create to finish creating the policy.

  References: https://docs.microsoft.com/en-us/microsoft-365/compliance/create-test-tune-dlp-policy?view=o365-worldwide

  https://docs.microsoft.com/en-us/microsoft-365/compliance/data-loss-prevention-policies?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/compliance/what-the-dlp-policy-templates-include?view=o365-worldwide

• Question 237:

  You need to create a case that prevents the members of a group named Operations from deleting email messages that contain the word IPO.

  To complete this task, sign in to the Microsoft Office 365 admin center.

  Correct Answer: See explanation below.

  1.

  Navigate to the Security and Compliance Center.

  2.

  In the Security and Compliance Center, click eDiscovery > eDiscovery, and then click Create a case.

  3.

  On the New Case page, give the case a name, type an optional description, and then click Save. The case name must be unique in your organization.

  

  The new case is displayed in the list of cases on the eDiscovery page.

  After you create a case, the next step is to add members to the case. The eDiscovery Manager who created the case is automatically added as a member. Members have to be assigned the appropriate eDiscovery permissions so they can access the case after you add them.

  4.

  In the Security and Compliance Center, click eDiscovery > eDiscovery to display the list of cases in your organization.

  5.

  Click the name of the case that you want to add members to.

  The Manage this case flyout page is displayed.

  6.

  Under Manage members, click Add to add members to the case.

  You can also choose to add a role group to the case. Under Manage role groups, click Add.

  7.

  In the list of people or role groups that can be added as members of the case, click the check box next to the names of the people or role groups that you want to add.

  8.

  After you select the people or role groups to add as members of the group, click Add.

  In Manage this case, click Save to save the new list of case members.

  9.

  Click Save to save the new list of case members.

  

  You can use an eDiscovery case to create holds to preserve content that might be relevant to the case. You can place a hold on the mailboxes and OneDrive for Business sites of people who are custodians in the case. You can also place a hold on the group mailbox, SharePoint site, and OneDrive for Business site for an Office 365 Group. Similarly, you can place a hold on the mailboxes and sites that are associated with Microsoft Teams or Yammer Groups. When you place content locations on hold, content is held until you remove the hold from the content location or until you delete the hold.

  To create a hold for an eDiscovery case:

  1.

  In the Security and Compliance Center, click eDiscovery > eDiscovery to display the list of cases in your organization.

  2.

  Click Open next to the case that you want to create the holds in.

  3.

  On the Home page for the case, click the Hold tab.

  4.

  On the Hold page, click Create.

  5.

  On the Name your hold page, give the hold a name. The name of the hold must be unique in your organization.

  6.

  (Optional) In the Description box, add a description of the hold.

  7.

  Click Next.

  8.

  Choose the content locations that you want to place on hold. You can place mailboxes, sites, and public folders on hold.

  

  

  

  a.

  Exchange email - Click Choose users, groups, or teams and then click Choose users, groups, or teams again. to specify mailboxes to place on hold. Use the search box to find user mailboxes and distribution groups (to place a hold on the mailboxes of group members) to place on hold. You can also place a hold on the associated mailbox for a Microsoft Team, a Yammer Group, or an Office 365 Group. Select the user, group, team check box, click Choose, and then click Done.

  a.

  In the box under Keywords, type a search query in the box so that only the content that meets the search criteria is placed on hold. You can specify keywords, message properties, or document properties, such as file names. You can also use more complex queries that use a Boolean operator, such as AND, OR, or NOT. If you leave the keyword box empty, then all content located in the specified content locations will be placed on hold.

  b.

  Click Add conditions to add one or more conditions to narrow the search query for the hold. Each condition adds a clause to the KQL search query that is created and run when you create the hold. For example, you can specify a date range so that email or site documents that were created within the date ranged are placed on hold. A condition is logically connected to the keyword query (specified in the keyword box) by the AND operator. That means that items have to satisfy both the keyword query and the condition to be placed on hold.

  

  9.

  After configuring a query-based hold, click Next.

  10.

  Review your settings, and then click Create this hold.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/ediscovery-cases?view=o365-worldwide

• Question 238:

  You need to ensure that [email protected] receives an alert when a user establishes a sync relationship to a document library from a computer that is a member of an Active Directory (AD) domain.

  To complete this task, sign in to the Microsoft Office 365 admin center.

  Correct Answer: See explanation below.

  1.

  Navigate to Manage Alerts in the Security and Compliance Center.

  2.

  On the Activity alerts page, click + New.

  3.

  Complete the following fields to create an activity alert:

  The flyout page to create an activity alert is displayed.

  

  a.

  Name - Type a name for the alert. Alert names must be unique within your organization.

  b.

  Description (Optional) - Describe the alert, such as the activities and users being tracked, and the users that email notifications are sent to. Descriptions provide a quick and easy way to describe the purpose of the alert to other admins.

  c.

  Alert type - Make sure the Custom option is selected.

  d.

  Send this alert when - Click Send this alert when and then configure these two fields:

  Activities - Click the drop-down list to display the activities that you can create an alert for. This is the same activities list that's displayed when you search the Office 365 audit log. You can select one or more specific activities or you can click

  the activity group name to select all activities in the group. For a description of these activities, see the "Audited activities" section in Search the audit log. When a user performs any of the activities that you've added to the alert, an email

  notification is sent.

  Users - Click this box and then select one or more users. If the users in this box perform the activities that you added to the Activities box, an alert will be sent. Leave the Users box blank to send an alert when any user in your organization

  performs the activities specified by the alert.

  e.

  Send this alert to - Click Send this alert, and then click in the Recipients box and type a name to add a user's who will receive an email notification when a user (specified in the Users box) performs an activity (specified in the Activities

  box). Note that you are added to the list of recipients by default. You can remove your name from this list.

  4. Click Save to create the alert.

  The new alert is displayed in the list on the Activity alerts page.

  

  The status of the alert is set to On. Note that the recipients who will receive an email notification when an alert is sent are also listed.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/create-activity-alerts?view=o365-worldwide

• Question 239:

  You need to ensure that email messages in Exchange Online and documents in SharePoint Online are retained for eight years.

  To complete this task, sign in to the Microsoft Office 365 admin center.

  Correct Answer: See explanation below.

  NB: For our purposes, the retention period will be 8 years.

  For retaining email messages in Exchange Online:

  Step 1: Create a retention tag

  1.

  Navigate to the Exchange Admin Center

  2.

  Navigate to Compliance management > Retention tags, and then click Add +

  3.

  Select one of the following options:

  Applied automatically to entire mailbox (default): Select this option to create a default policy tag (DPT). You can use DPTs to create a default deletion policy and a default archive policy, which applies to all items in the mailbox.

  Applied automatically to a specific folder: Select this option to create a retention policy tag (RPT) for a default folder such as Inbox or Deleted Items.

  Applied by users to items and folders (Personal): Select this option to create personal tags. These tags allow Outlook and Outlook on the web (formerly known as Outlook Web App) users to apply archive or deletion settings to a message

  or folders that are different from the settings applied to the parent folder or the entire mailbox.

  4.

  The New retention tag page title and options will vary depending on the type of tag you selected. Complete the following fields:

  Name: Enter a name for the retention tag. The tag name is for display purposes and doesn't have any impact on the folder or item a tag is applied to. Consider that the personal tags you provision for users are available in Outlook and Outlook

  on the web.

  Apply this tag to the following default folder: This option is available only if you selected Applied automatically to a specific folder.

  Retention action: Select one of the following actions to be taken after the item reaches its retention period:

  Delete and Allow Recovery: Select this action to delete items but allow users to recover them using the Recover Deleted Items option in Outlook or Outlook on the web. Items are retained until the deleted item retention period configured for

  the mailbox database or the mailbox user is reached.

  Permanently Delete: Select this option to permanently delete the item from the mailbox database.

  Move to Archive: This action is available only if you're creating a DPT or a personal tag. Select this action to move items to the user's In-Place Archive.

  Retention period: Select one of the following options:

  Never: Select this option to specify that items should never be deleted or moved to the archive.

  When the item reaches the following age (in days): Select this option and specify the number of days to retain items before they're moved or deleted. The retention age for all supported items except Calendar and Tasks is calculated from

  the date an item is received or created. Retention age for Calendar and Tasks items is calculated from the end date.

  Comment: User this optional field to enter any administrative notes or comments. The field isn't displayed to users.

  Step 2: Create a retention policy

  1.

  Navigate to Compliance management > Retention policies, and then click Add +

  2.

  In New Retention Policy, complete the following fields:

  Name: Enter a name for the retention policy.

  Retention tags: Click Add + to select the tags you want to add to this retention policy.

  A retention policy can contain the following tags:

  One DPT with the Move to Archive action.

  One DPT with the Delete and Allow Recovery or Permanently Delete actions.

  One DPT for voice mail messages with the Delete and Allow Recovery or Permanently Delete actions.

  One RPT per default folder such as Inbox to delete items.

  Any number of personal tags.

  Step 3: Apply a retention policy to mailbox users

  After you create a retention policy, you must apply it to mailbox users. You can apply different retention policies to different set of users.

  1.

  Navigate to Recipients > Mailboxes.

  2.

  In the list view, use the Shift or Ctrl keys to select multiple mailboxes.

  3.

  In the details pane, click More options.

  4.

  Under Retention Policy, click Update.

  5.

  In Bulk Assign Retention Policy, select the retention policy you want to apply to the mailboxes, and then click Save.

  For retaining documents in SharePoint Online

  Access Security and Compliance Admin Center

  1.

  Navigate to the Office 365 Admin Centers

  2.

  From the list of available Admin Centers, click on Security and Compliance

  

  

  How to create and publish a Retention Policy on a SharePoint site

  Now that we are in the Security and Compliance Admin Center, we are ready to create and publish a Retention Policy on a SharePoint site. Under Data Governance, click Retention

  

  1. Hit Create button to create new Retention Policy

  

  2.

  Give your policy a name and description. Hit Next

  3.

  On the next screen is where you set up the logic. You can configure how many days, months, or years to retain the content for, specify whether you want the math (retention period) to be calculated from the Created Date or Last Modified Date. Lastly, you can also specify whether you want to keep or delete content after the Retention period expires. Hit Next

  4.

  On the next screen, you get to choose where to apply the policy. You can apply it to email (Exchange), SharePoint sites, OneDrive accounts as well as Office 365 Groups.

  

  

  

  5. In my case, I applied a policy to a single Office 365 Group Site

  

  6. On a final screen, you need to review and confirm the settings and click Create this policy button. It is imperative to note the message you get to see at the bottom. It warns you that content might be deleted as soon as the policy takes effect according to the logic you set up in previous steps.

  

  Reference:

  https://docs.microsoft.com/en-us/exchange/security-and-compliance/messaging-records-management/create-a-retention-policy#step-2-create-a-retention-policy

  https://docs.microsoft.com/en-us/exchange/security-and-compliance/messaging-records-management/apply-retention-policy#use-the-eac-to-apply-a-retention-policy-to-multiple-mailboxes

  https://sharepointmaven.com/how-to-set-a-retention-policy-on-a-sharepoint-site/

• Question 240:

  You need to ensure that a user named Allan Deyoung can perform searches and place holds on mailboxes, SharePoint Online sites, and OneDrive for Business locations. The solution must use the principle of least privilege.

  To complete this task, sign in to the Microsoft 365 admin center.

  Correct Answer: See explanation below.

  1.

  After signing in to the Microsoft 365 admin center, navigate to the Security and Compliance Center.

  2.

  In the left pane of the security and compliance center, select Permissions, and then select the checkbox next to eDiscovery Manager.

  3.

  On the eDiscovery Manager flyout page, do one of the following based on the eDiscovery permissions that you want to assign.

  To make a user an eDiscovery Manager: Next to eDiscovery Manager, select Edit. In the Choose eDiscovery Manager section, select the Choose eDiscovery Manager hyperlink, and then select + Add. Select the user (or users) you

  want to add as an eDiscovery manager, and then select Add. When you're finished adding users, select Done. Then, on the Editing Choose eDiscovery Manager flyout page, select Save to save the changes to the eDiscovery Manager

  membership.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/assign-ediscovery-permissions?view=o365-worldwide