Microsoft Microsoft Certifications MS-500 Questions & Answers

• Question 71:

  You have a Microsoft 365 E5 subscription that contains 500 Windows 10 devices The subscription uses Microsoft Defender for Endpoint and is integrated with Microsoft Endpoint Manager. AJI the devices have Defender for Endpoint deployed.

  You create a Conditional Access policy as shown in the following table.

  

  You need to ensure that devices that have a machine risk score of high are blocked. What should you do in Microsoft Endpoint Manager?

  A. Apply a security baseline to all the devices.

  B. Apply an endpoint detection and response policy to the subscription.

  C. Configure the Compliance policy settings.

  D. Apply a compliance policy to all the devices.

  Correct Answer: B

• Question 72:

  You have an Azure Active Directory (Azure AD) tenant that has a Microsoft 365 subscription

  You recently configured the tenant to require multi factor authentication (MFA) for risky sign ins

  You need to review the users who required MFA.

  What should you do?

  A. From the Microsoft 365 admin center, review a Security and Compliance report.

  B. From the Azure Active Directory admin center, download the sign-ms to a CSV file

  C. From the Microsoft 365 Compliance admin center, run an audit log search and download the results to a CSV file

  D. From the Azure Active Directory admin center, review the Authentication methods activities.

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-reporting

• Question 73:

  You have a Microsoft 365 Enterprise E5 subscription.

  You use Microsoft Defender for Endpoint.

  You need to integrate Microsoft Defender for Office 365 and Microsoft Defender for Endpoint

  Where should you configure the integration?

  A. From the Microsoft 365 admin center, select Settings, and then select Services fit add-ins

  B. From the Microsoft 365 Defender portal, select Settings and then select Security center.

  C. From the Microsoft 365 admin center, select Reports and then select Security and Compliance

  D. From the Microsoft 365 Defender portal, select Explorer and then select MDE Settings

  Correct Answer: D

  To integrate Microsoft Defender for Office 365 with Microsoft Defender for Endpoint

  Integrating Microsoft Defender for Office 365 with Microsoft Defender for Endpoint is set up in both Defender for Endpoint and Defender for Office 365.

  1.

  Go to the Microsoft 365 Defender portal (https://security.microsoft.com) and sign in.

  2.

  Go to Email and collaboration > Explorer.

  3.

  On the Explorer page, in the upper right corner of the screen, select MDE Settings.

  4.

  In the Microsoft Defender for Endpoint connection flyout that appears, turn on Connect to Microsoft Defender for Endpoint (Toggle on.) and then select Close.

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/integrate-office-365-ti-with-mde?view=o365-worldwide

• Question 74:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a Microsoft 365 E5 subscription that contains a user named User1.

  The Azure Active Directory (Azure AD) Identity Protection risky users report identifies User1.

  For User1, you select Confirm user compromised.

  User1 can still sign in.

  You need to prevent User1 from signing in. The solution must minimize the impact on users at a tower risk level.

  Solution: From the Access settings, you select Block access for User1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk

• Question 75:

  You have a Microsoft 365 subscription that contains several Windows 10 devices. The devices are managed by using Microsoft Endpoint Manager.

  You need to enable Microsoft Defender Exploit Guard (Microsoft Defender EG) on the devices.

  Which type of device configuration profile should you use?

  A. Endpoint protection

  B. Device restrictions

  C. Microsoft Defender for Endpoint

  D. identity protection

  Correct Answer: A

  https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/create-deploy-exploit-guard-policy

• Question 76:

  You have multiple Microsoft 365 subscriptions.

  You need to build an application that will retrieve the Microsoft Secure Score data of each subscription.

  What should you use?

  A. the Microsoft Defender for Endpoint API

  B. the Microsoft Graph Security API

  C. the Microsoft Office 365 Management API

  D. the Azure Monitor REST API

  Correct Answer: C

• Question 77:

  You have a Microsoft 365 E5 subscription that contains two users named User1 and User2. On January 1. you create the sensitivity label shown in the following table.

  

  1.

  On January 2, you publish label to User1.

  2.

  On January 3. User 1 creates a Microsoft Word document named Doc1 and applies Label to the document.

  3.

  On January 4. User2 edits Doc1.

  4.

  On January 15, you increase the content expiry period for Label to 28 days. When will access to Doc1 expire for User2?

  A. January 23

  B. January 24

  C. January 25

  D. January 31

  Correct Answer: D

  According to this 'if you edit a sensitivity label, the version of the label that was applied to the document remains in effect' So the answer is Absolutely B, as the question does not mention the user reapplying the label. https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide

• Question 78:

  You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

  

  You enable Customer Lockbox.

  Which users will be notified when a Microsoft support engineer requests access to the organization?

  A. Admin1, Admin2. and Admin3

  B. Admin2only

  C. Admin2 and Admin3 only

  D. Admin1 and Admin2 only

  Correct Answer: D

  Anyone who is assigned the Customer Lockbox access approver admin role in Microsoft 365 admin center can approve Customer Lockbox requests. Approve or deny a Customer Lockbox request

  1.

  Using a work or school account that has either the global administrator or the Customer Lockbox access approver role assigned, go to https:// admin.microsoft.com and sign in.

  2.

  Choose Support > Customer Lockbox Requests.

  3.

  Etc.

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/compliance/customer-lockbox-requests

• Question 79:

  You have a Microsoft 365 E5 subscription.

  You create a sensitivity label named Label 1 and publish Label1 to all users and groups.

  You have the following files on a computer:

  1.

  File1.doc

  2.

  File2.docx

  3.

  File3.xlsx

  4.

  File4.txt

  You need to identify which files can have Label1 applied. Which files should you identify?

  A. File2.docx only

  B. File1.doc. File2.docx. File3.xlsx. a

  C. File1 .doc. File2.docx, and File3.xlsx only

  D. File2.docx and File3.xlsx only

  Correct Answer: C

  Use of Azure Information Protection Client is still supported and documented. The .txt file types is supported for classification and protection.

  Documentation: https://learn.microsoft.com/en-us/azure/information-protection/rms-client/clientv2-admin-guide-file-types

• Question 80:

  You have a Microsoft 365 tenant that has modern authentication enabled.

  You have Windows 10, MacOS. Android, and iOS devices that are managed by using Microsoft Endpoint Manager. Some users have older email client applications that use Basic authentication to connect to Microsoft Exchange Online. You need to implement a solution to meet the following security requirements:

  1.

  Allow users to connect to Exchange Online only by using email client applications that support modern authentication protocols based on OAuth 2.0.

  2.

  Block connections to Exchange Online by any email client applications that do NOT support modern authentication.

  What should you implement?

  A. a conditional access policy in Azure Active Directory (Azure AD)

  B. an OAuth app policy m Microsoft Defender for Cloud Apps

  C. a compliance policy in Microsoft Endpoint Manager

  D. an application control profile in Microsoft Endpoint Manager

  Correct Answer: A

  Block clients that don't support multi-factor with a Conditional Access policy.

  Note: Clients that do not use modern authentication can bypass Conditional Access policies, so it's important to block these.

  Incorrect:

  Not D: OAuth app policies enable you to investigate which permissions each app requested and which users authorized them for Office 365, Google Workspace, and Salesforce. You're also able to mark these permissions as approved or

  banned.

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/identity-access-policies