Microsoft Microsoft Certifications MS-500 Questions & Answers

• Question 281:

  HOTSPOT

  You have a Microsoft Defender for Endpoint deployment that has custom network indicators turned on. Microsoft Defender for Endpoint protects two computers that run Windows 10 as shown in the following table.

  

  Microsoft Defender foe Endpoint has the device groups shown in the following table.

  

  From Microsoft Defender Security Center, you create the URLs/Domains indicators shown in the following table.

  

  Hot Area:

  

  Correct Answer:

  

  Computer1 www.contoso.com > No

  1.

  No, as Computer1 is Member of Group1 and group1 prohibits access.

  Computer1 www.litwareinc.com/public > Yes

  2.

  Yes, as there is no block for this URL at all.

  Computer2 www.litwareinc.com > Yes

  3.

  Yes, as Computer2 is a member of Group1 and Group1 does not have a block for this URL.

  Computers can only be part of one group

  based on the ranking if conditions are met for multiple groups.

  Group1 membership is higher than Group2, so Computer2 is in Group1.

  Computer can be member on just 1 atp group, and priority is used

  Both computers are on group1 because contains 1 and group 1 have the highest priority.

  "Specify the matching rule that determines which device group belongs to the group based on the device name, domain, tags, and OS platform.

  If a device is also matched to other groups, it's added only to the highest ranked device group"

  https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/machine-groups

• Question 282:

  HOTSPOT

  You have a Microsoft 365 Tenant.

  A conditional access policy is configured for the tenant as shown in the Policy exhibit. (Click the Policy tab.)

  

  The User Administrator role a configured as shown in the Hole setting exhibit (Click the Role setting tab.)

  

  The User Administrator role has the assignments shown in the Assignments exhibit (Click the Assignments tab.)

  

  For each of the following statements, select yes If the statement is true. Otherwise select No. NOTE Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  In this scenario the User Administrator role is require justification on active assignment.

  Require justification

  You can require that users enter a business justification when they activate. To require justification, check the Require justification on active assignment box or the

  Require justification on activation box.

  Box 2: Yes

  Activation maximum duration is 8 hours.

  Box 3: Yes

  Require multifactor authentication

  Privileged Identity Management provides enforcement of Azure AD Multi-Factor Authentication on activation and on active assignment.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-change-default-settings

• Question 283:

  HOTSPOT

  You have a Microsoft 365 subscription that contains the users shown in the following table.

  

  Group1 is member of a group named Group3.

  The Azure Active Directory (Azure AD) tenant contains the Windows 10 devices shown in the following table.

  

  Microsoft Endpoint Manager has the devices shown in the following table.

  

  Microsoft Endpoint Manager contains the compliance policies shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Deploy to users in user groups or devices in device groups. When a compliance policy is deployed to a user, all the user's devices are checked for compliance. Using device groups in this scenario helps with compliance reporting.

• Question 284:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2 and the users shown in the following table.

  

  You have the Privileged Access settings configured as shown in the following exhibit.

  

  You have a privileged access policy that has the following settings:

  1.

  Policy name: New Transport Rule

  2.

  Policy type: Task

  3.

  Policy scope Exchange

  4.

  Approval Type: Manual

  5.

  Approver group: Group 1

  User1 requests access to the New Transport Rule policy for a duration of two hours.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  N - If an approver is defined then Global/PIM admins can't approve N - User cannot approver their own requests N - approver defined is user group1 and user 2 is in group2 so they can't approve.

• Question 285:

  HOTSPOT

  You have a Microsoft 365 subscription that contains the groups shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 286:

  HOTSPOT

  You have a Microsoft 365 subscription that contains 100 users.

  Microsoft Secure Score for the subscription is shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the the information presented in the graphic. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 27 points

  Security defaults

  Microsoft Secure Score has updated improvement actions to support security defaults in Azure Active Directory, which make it easier to help protect your organization with pre-configured security settings for common attacks.

  If you turn on security defaults, you'll be awarded full points for the following improvement actions:

  Ensure all users can complete multi-factor authentication for secure access (9 points)

  Require MFA for administrative roles (10 points)

  Enable policy to block legacy authentication (7 points)

  Box 2: 3 points

  Some improvement actions only give points when fully completed. Some give partial points if they're completed for some devices or users.

  In this case: 30/100 * 10 = 3 points

  Note: How improvement actions are scored

  Each improvement action is worth 10 points or less, and most are scored in a binary fashion. If you implement the improvement action, like create a new policy or turn on a specific setting, you get 100% of the points. For other improvement

  actions, points are given as a percentage of the total configuration.

  For example, an improvement action states you get 10 points by protecting all your users with multi-factor authentication. You only have 50 of 100 total users protected, so you'd get a partial score of 5 points (50 protected / 100 total * 10 max

  pts = 5 pts).

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/security/defender/microsoft-secure-score

• Question 287:

  HOTSPOT

  You have a Microsoft Sentinel workspace that has an Azure Active Directory (Azure AD) connector and an Office 365 connector.

  From the workspace, you plan to create an analytics rule that will be based on a custom query and will run a security play.

  You need to ensure that you can add the security playbook and the custom query to the rule.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Scheduled Create a custom analytics rule with a scheduled query

  1.

  From the Microsoft Sentinel navigation menu, select Analytics.

  2.

  In the action bar at the top, select +Create and select Scheduled query rule. This opens the Analytics rule wizard.

  3.

  Etc.

  Box 2: A trigger

  Use triggers and actions in Microsoft Sentinel playbooks.

  Reference:

  https://docs.microsoft.com/en-us/azure/sentinel/detect-threats-custom https://docs.microsoft.com/en-us/azure/sentinel/playbook-triggers-actions#microsoft-sentinel-triggers-summary

• Question 288:

  HOTSPOT

  You have a Microsoft SharePoint Online site named Site. That has the users shown in the following table.

  

  You create the retention labels shown In the following table.

  

  You publish the retention labels to Site1.

  On March 1, 2021, you assign the retention labels to the files shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Regarding the first question, retention policies/labels do not change the regular operation of office docs. So the file can be deleted. Actually, the only interruption by the retention feature is that users receive an error if they try to delete a document library or site subject to a retention policy.

• Question 289:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

  

  You have the devices shown in the following table.

  

  You have the Microsoft Defender for Endpoint portal roles shown in the following table.

  

  You have the Microsoft Defender for Endpoint device groups shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box1 - User1 can manage alerts for Device2 → Yes Reason: User1 is security administrator. By default he has full access. When you first log in to the Microsoft 365 Defender portal, you're granted either full access or read only access. Full access rights are granted to users with Security Administrator or Global Administrator roles in Azure AD. Box2 - User3 can manage alerts for Device3 → No Reason: User3 (User Administrator) has no default access. He is a member of ADGroup3. Role 3 is assigned to ADGroup3. Remediation level for Group3: Semi – Require approval for all folders So user3 cannot manage alerts for Device3

  Box3: Remediation level for device3: Semi – Require approval for all folders → No

  Device3 is Windows 10 device and will match Group1 (Highest Rank group)

  A device group with a rank of 1 is the highest ranked group. When a device is matched to more than one group, it's added only to the highest ranked group.

• Question 290:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

  

  For contoso.com, you create a group naming policy that has the following configuration.

  -

  You plan to create the groups shown in the following table.

  

  Which users can be used to create each group? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference:

  https://office365itpros.com/2020/01/22/using-groups-admin-role/

  https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference