Microsoft Microsoft Certifications MS-500 Questions & Answers

• Question 31:

  You have a Microsoft 365 E5 subscription.

  You plan to implement retention policies for Microsoft Teams.

  Which item types can be retained?

  A. voice memos from the Teams mobile client

  B. code snippets

  C. embedded images

  Correct Answer: C

  Code snippets, recorded voice memos from the Teams mobile client, thumbnails, announcement images, and reactions from others in the form of emoticons aren't retained when you use retention policies for Teams.

  Reference:

  https://docs.microsoft.com/en-us/microsoftteams/teams-recording-policy

• Question 32:

  You have a Microsoft 365 subscription for a company named Contoso, Ltd. All data is in Microsoft 365.

  Contoso works with a partner company named Litware, Inc. Litware has a Microsoft 365 subscription. Microsoft OneDrive has the default settings.

  You need to allow users at Contoso to share files from Microsoft OneDrive to specific users at Litware.

  Which two actions should you perform from the OneDrive admin center? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Configure the permission level for OneDrive External sharing to be more restrictive.

  B. Modify the Device access settings.

  C. Configure the permission level for OneDrive External sharing to be less restrictive.

  D. Change the permissions for OneDrive External sharing to the least permissive level.

  E. Modify the Sync settings.

  F. Modify the Links settings.

  Correct Answer: AF

  https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off#change-the-organization-level-external-sharing-setting

• Question 33:

  You have a Microsoft 365 E5 subscription that contains 100 users. Each user has a computer that runs Windows 10 and either an Android mobile device or an iOS mobile device. All the devices are registered with Azure Active Directory (Azure AD).

  You enable passwordless authentication for all the users.

  You need to ensure that the users can sign in to the subscription by using passwordless authentication.

  What should you instruct the users to do on their mobile device first?

  A. Install a device certificate.

  B. Install a user certificate.

  C. Install the Microsoft Authenticator app.

  D. Register for self-service password reset (SSPR).

  Correct Answer: C

  The Authenticator App turns any iOS or Android phone into a strong, passwordless credential.

  Note: Microsoft Authenticator App

  You can allow your employee's phone to become a passwordless authentication method. You may already be using the Microsoft Authenticator App as a convenient multi-factor authentication option in addition to a password. You can also

  use the Authenticator App as a passwordless option.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless

• Question 34:

  Your network contains an on-premises Active Directory domain. The domain contains a domain controller named DC1.

  You have a Microsoft 365 E5 subscription.

  You install the Microsoft Defender for Identity sensor on DC1.

  You need to configure enhanced threat detection in Defender for Identity. The solution must ensure that the following events are collected from DC1:

  1.

  4726 - User Account Deleted

  2.

  4728 - Member Added to Global Security Group

  3.

  4776 - Domain Controller Attempted to Validate Credentials for an Account (NTLM)

  What should you do on DC1?

  A. Install the Azure Monitor agent.

  B. Install System Monitor (SYSMON).

  C. Configure the Windows Event Collector service.

  D. Configure the Advanced Audit Policy Configuration policy.

  Correct Answer: D

  Windows Event logs Defender for Identity detection relies on specific Windows Event logs that the sensor parses from your domain controllers. For the correct events to be audited and included in the Windows Event log, your domain controllers require accurate Advanced Audit Policy settings. For the correct events to be audited and included in the Windows Event Log, your domain controllers require accurate Advanced Audit Policy settings. Incorrect Advanced Audit Policy settings can lead to the required events not being recorded in the Event Log and result in incomplete Defender for Identity coverage. Note: Relevant Windows Events For Active Directory Federation Services (AD FS) events 1202 - The Federation Service validated a new credential 1203 - The Federation Service failed to validate a new credential 4624 - An account was successfully logged on 4625 - An account failed to log on

  For other events 1644 - LDAP search 4662 - An operation was performed on an object 4726 - User Account Deleted 4728 - Member Added to Global Security Group 4729 - Member Removed from Global Security Group 4730 - Global Security Group Deleted 4732 - Member Added to Local Security Group 4733 - Member Removed from Local Security Group 4741 - Computer Account Added 4743 - Computer Account Deleted 4753 - Global Distribution Group Deleted 4756 - Member Added to Universal Security Group 4757 - Member Removed from Universal Security Group 4758 - Universal Security Group Deleted 4763 - Universal Distribution Group Deleted 4776 - Domain Controller Attempted to Validate Credentials for an Account (NTLM) 7045 - New Service Installed 8004 - NTLM Authentication Reference: https://docs.microsoft.com/en-us/defender-for-identity/prerequisites https://docs.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection

• Question 35:

  You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

  

  You have the core eDiscovery cases shown in the following table.

  

  You need to ensure that Admin3 can create holds in Case1 and Case2. The solution must use the principle of least privilege.

  To what should you add Admin3?

  A. the eDiscovery Administrator role group

  B. the Global administrator role

  C. the eDiscovery Manager role group

  D. the Compliance Manager Contributors role group

  Correct Answer: A

  eDiscovery Administrator - An eDiscovery Administrator is a member of the eDiscovery Manager role group, and can perform the same content search and case management-related tasks that an eDiscovery Manager can perform.

  Additionally, an eDiscovery Administrator can:

  Access all cases that are listed on the eDiscovery (Standard) and eDiscovery (Premium) pages in the compliance portal.

  Access case data in eDiscovery (Premium) for any case in the organization.

  Manage any eDiscovery case after they add themselves as a member of the case.

  Remove members from an eDiscovery case. Only an eDiscovery Administrator can remove members from a case. Users who are members of the eDiscovery Manager subgroup can't remove members from a case, even if the user created

  the case.

  eDiscovery Managers can only access and manage the cases they create. They can't access or manage cases created by other eDiscovery Managers.

  https://learn.microsoft.com/en-us/microsoft-365/compliance/ediscovery-assign-permissions?view=o365-worldwide

• Question 36:

  You have a Microsoft 365 E5 subscription that contains a user named User1 and a Microsoft SharePoint Online site named Site1. You create the alert policy shown in the following exhibit.

  

  To Site1, User1 uploads the files shown in the following table.

  

  How many alerts will be generated in response to the file uploads?

  A. 1

  B. 2

  C. 3

  D. 4

  E. 5

  Correct Answer: E

  5 Alerts as conditions for alert are:

  Upload of a file, extension of file is docx

  No aggregation here and 5 docx files were uploaded.

• Question 37:

  You have a Microsoft SharePoint Online site named Site1 that contains the files shown in the following table.

  

  You have a data loss prevention (DLP) policy named DLP1 that has the advanced DLP rules shown in the following table.

  

  You apply DLP1 to Site1.

  Which policy tips will appear for File2?

  A. Tip2 only

  B. Tip3 only

  C. Tip1 only

  D. Tip1 and Tip2 only

  Correct Answer: D

  Rule1 will add Tip1, and Rule2 will add Tip2. Rule3 will not be applied as processing stops with Rule2.

  Note: The Priority parameter specifies a priority value for the policy that determines the order of policy processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and policies can't have the same priority

  value.

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/compliance/dlp-policy-reference

• Question 38:

  You have a Microsoft 365 E5 subscription that contains the resources shown in the following table.

  

  You have a retention label configured as shown in the following exhibit.

  

  You apply the label to the resources. Which items can you delete?

  A. Mail1 only

  B. File1.docx and File2.xlsx only

  C. Mail1 and File1.docx only

  D. Mail1 and File2.xlsx only

  E. Mail1, File1.docx, and File2.xlsx

  Correct Answer: E

  All the items can be deleted according to the settings https://docs.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide#how-retention-settings-work-with-content-in-place

• Question 39:

  You have a Microsoft 365 E5 subscription that contains the devices shown in the following table.

  

  The devices are enrolled in Microsoft Endpoint Manager. Which devices will be included in the encryption report?

  A. Device1, Device3, and Device4 only

  B. Device1 only

  C. Device1 and Device2 only

  D. Device2 and Device4 only

  E. Device1, Device2, Device3, and Device4

  Correct Answer: C

  The encryption report supports reporting on devices that run the following operating system versions: macOS 10.13 or later Windows version 1607 or later

  reference: https://learn.microsoft.com/en-us/mem/intune/protect/encryption-monitor

• Question 40:

  A company named Contoso, Ltd. acquires a company named Fabrikam, Inc.

  Users at each company continue to use their company's Microsoft 365 tenant. Both companies have hybrid Azure Active Directory (Azure AD) tenants configured as shown in the following table.

  

  In the Contoso tenant, you create a new Microsoft 365 group named FabrikamUsers, and you add FabrikamUsers as a member of a Microsoft Teams team named Corporate.

  You need to add Fabrikam users to the FabrikamUsers group.

  What should you do first?

  A. Configure the Contoso tenant to use pass-through authentication as the authentication method.

  B. In the Contoso tenant, create a new conditional access policy.

  C. In the Contoso tenant, create guest accounts for all the Fabrikam users.

  D. Configure the Fabrikam tenant to use federation as the authentication method.

  Correct Answer: C

  Since both companies have hybrid Azure AD tenants, creating guest accounts for Fabrikam users in the Contoso tenant would allow them to access the FabrikamUsers group in the Corporate Teams team. Option A is not necessary for this task. Option B is not relevant to adding Fabrikam users to a group. Option D is also not necessary as both companies already have hybrid Azure AD tenants.