Black Friday Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

Microsoft MS-500 Microsoft 365 Security Administration Exam Practice Test

Demo: 49 questions
Total 327 questions

Microsoft 365 Security Administration Questions and Answers

Question 1

You have a Microsoft 365 that uses Microsoft ShareP0•int Online.

You need to ensure that users can only share files with users at specified partner companies. The solution must minimize administrative effort.

What should you do?

Options:

A.

Allow only in specific security groups to share externally.

B.

Set File and folder links to people.

C.

Limit external by domain

D.

Set External sharing to New and existing guest

Question 2

Your network contains an on-premises Active Directory domain named contoso.local that has a forest functional level of Windows Server 2008 R2.

You have a Microsoft 365 E5 subscription linked to an Azure Active Directory (Azure AD) tenant named contoso.com.

You plan to install Azure AD Connect and enable single sign-on (SSO).

You need to prepare the domain to support SSO. The solution must minimize administrative effort.

What should you do?

Options:

A.

Raise the forest functional level to Windows Server 2016.

B.

Modify the UPN suffix of all domain users.

C.

Populate the mail attribute of all domain users.

D.

Rename the domain.

Question 3

You have a Microsoft 365 subscription for a company named Contoso, Ltd. All data is in Microsoft 365.

Contoso works with a partner company named Litware. Inc. Litware has a Microsoft 365 subscription, Microsoft OneDrive has the default settings.

You need to allow users at Contoso to share files from Microsoft OneDrive only to specific users at Litware.

Which two actions should you perform from the SharePoint admin center? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Options:

A.

Modify the Links settings.

B.

Change the permissions for OneDrive External sharing to the least permissive level.

C.

Configure the permission level for OneDrive External sharing to be less restrictive.

D.

Modify the Device access settings.

E.

Configure the permission level for OneDrive External sharing to be more restrictive.

F.

Modify the Sync settings.

Question 4

You have a Microsoft 365 subscription.

You need to create data loss prevention (DLP) queries in Microsoft SharePoint Online to find sensitive data stored in sites.

Which type of site collection should you create first?

Options:

A.

Records Center

B.

Compliance Policy Center

C.

eDiscovery Center

D.

Enterprise Search Center

E.

Document Center

Question 5

You have a Microsoft 365 subscription.

You need to enable auditing for all Microsoft Exchange Online users.

What should you do?

Options:

A.

From the Exchange admin center, create a journal rule

B.

Run the Set-MailboxDatabase cmdlet

C.

Run the Set-Mailbox cmdlet

D.

From the Exchange admin center, create a mail flow message trace rule.

Question 6

You have a Microsoft 365 subscription that uses an Azure Active Directory (Azure AD) tenant named contoso.com. All the devices in the tenant are managed by using Microsoft Intune.

You purchase a cloud app named App1 that supports session controls.

You need to ensure that access to App can be reviewed in real time.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Options:

Question 7

You have a Microsoft 365 E5 subscription that is linked to an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains three groups named Group!, Group2. and Group3 and the users shown in the following table.

You create a new access package as shown in the following exhibit.

You have a Microsoft 365 E5 subscription that uses Microsoft Endpoint Manager. The Compliance policy settings are configured as shown in the following exhibit.

These settings configure the way the compliance service treats devices. Each device evaluates these as a "Built-in Device Compliance Policy", which is reflected in device monitoring.

Options:

Question 8

You have a Microsoft 365 subscription.

Your company uses Jamf Pro to manage macOS devices.

You plan to create device compliance policies for the macOS devices based on the Jamf Pro data.

You need to connect Microsoft Endpoint Manager to Jamf Pro.

What should you do first?

Options:

A.

From the Azure Active Directory admin center, add a Mobility (MDM and MAM) application.

B.

From the Endpoint Management admin center, add the Mobile Threat Defense connector.

C.

From the Endpoint Management admin center, configure Partner device management.

D.

From the Azure Active Directory admin center, register an application.

Question 9

You need to ensure that a user named Grady Archie can monitor the service health of your Microsoft 365 tenant. The solution must use the principle of least privilege.

To complete this task, sign in to the Microsoft 365 portal.

Options:

Question 10

You have a Microsoft 365 subscription.

Yesterday, you created retention labels and published the labels to Microsoft Exchange Online mailboxes.

You need to ensure that the labels will be available for manual assignment as soon as possible.

What should you do?

Options:

A.

From the Security & Compliance admin center, create a label policy

B.

From Exchange Online PowerShell, run Start-RetentionAutoTagLearning

C.

From Exchange Online PowerShell, run Start-ManagedFolderAssistant

D.

From the Security & Compliance admin center, create a data loss prevention (DLP) policy

Question 11

You have a Microsoft 365 E5 subscription that contains three users named User1, User2 and User3.

You have Azure AD roles that have the role activation settings shown in the following table.

You have Azure AD roles that have the role assignment settings shown in the following table.

The Azure AD roles have eligible users assigned as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Options:

Question 12

Your company has a Microsoft 365 subscription.

The company forbids users to enroll personal devices in mobile device management (MDM).

Users in the sales department have personal iOS devices.

You need to ensure that the sales department users can use the Microsoft Power BI app from iOS devices to access the Power BI data in your tenant.

The users must be prevented from backing up the app’s data to iCloud.

What should you create?

Options:

A.

a conditional access policy in Microsoft Azure Active Directory (Azure AD) that has a device state

condition

B.

an app protection policy in Microsoft Intune

C.

a conditional access policy in Microsoft Azure Active Directory (Azure AD) that has a client apps condition

D.

a device compliance policy in Microsoft Intune

Question 13

You have a Microsoft 365 subscription that contains a Microsoft SharePoint Online site named Site1. Site1 contains the folders shown in the following table.

At 09:00, you create a Microsoft Cloud App Security policy named Policy1 as shown in the following exhibit.

After you create Policy1, you upload files to Site1 as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Options:

Question 14

Please wait while the virtual machine loads. Once loaded, you may proceed to the lab section. This may take a few minutes, and the wait time will not be deducted from your overall test time.

When the Next button is available, click it to access the lab section. In this section, you will perform a set of tasks in a live environment. While most functionality will be available to you as it would be in a live environment, some functionality (e.g., copy and paste, ability to navigate to external websites) will not be possible by design.

Scoring is based on the outcome of performing the tasks stated in the lab. In other words, it doesn’t matter how you accomplish the task, if you successfully perform it, you will earn credit for that task.

Labs are not timed separately, and this exam may more than one lab that you must complete. You can use as much time as you would like to complete each lab. But, you should manage your time appropriately to ensure that you are able to complete the lab(s) and all other sections of the exam in the time provided.

Please note that once you submit your work by clicking the Next button within a lab, you will NOT be able to return to the lab.

Username and password

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Microsoft 365 Username:

admin@LODSe244001@onmicrosoft.com

Microsoft 365 Password: &=Q8v@2qGzYz

If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

The following information is for technical support only:

Lab instance: 11032396

You need to ensure that when users tag documents as classified, a classified watermark is applied to the documents.

To complete this task, sign in to the Microsoft Office 365 admin center.

Options:

Question 15

Von haw a Microsoft 365 subscription.

You need to ensure that users on manually designate which content will be subject to data toss prevention (DIP) polices?

What should you create first?

Options:

A.

a retention label

B.

a custom sensitive information type

C.

a safe attachments policy

D.

a Data Subject Request (OSR)

Question 16

You have a Microsoft 365 subscription that contains 100 users.

Microsoft Secure Score for the subscription is shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the the information presented in the graphic.

NOTE: Each correct selection is worth one point.

Options:

Question 17

You have a Microsoft 365 subscription linked to an Azure Active Directory (Azure AD) tenant that contains a user named User1.

You have a Data Subject Request (DSR) case named Case1.

You need to allow User1 to export the results of Case1. The solution must use the principle of least privilege.

Which role should you assign to User1 for Case1?

Options:

A.

eDiscovery Manager

B.

Security Operator

C.

eDiscovery Administrator

D.

Global Reader

Question 18

You need to create a policy that identifies content in Microsoft OneDrive that contains credit card numbers.

To complete this task, sign in to the Microsoft 365 portal.

Options:

Question 19

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft 365 E5 subscription that contains a user named User1.

The Azure Active Directory (Azure AD) Identity Protection risky users report identifies User1.

For User1, you select Confirm user compromised.

User1 can still sign in.

You need to prevent User1 from signing in. The solution must minimize the impact on users at a lower risk level.

Solution: You configure the sign-in risk policy to block access when the sign-in risk level is high.

Does this meet the goal?

Options:

A.

Yes

B.

No

Question 20

You have a Microsoft 365 subscription for a company named Contoso, Ltd. All data is in Microsoft 365.

Contoso works with a partner company named Litware, Inc. Litware has a Microsoft 365 subscription.

You need to allow users at Contoso to share files from Microsoft OneDrive to specific users at Litware.

Which two actions should you perform from the OneDrive admin center? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Options:

A.

Increase the permission level for OneDrive External sharing

B.

Modify the Links settings

C.

Change the permissions for OneDrive External sharing to the least permissive level

D.

Decrease the permission level for OneDrive External sharing

E.

Modify the Device access settings

F.

Modify the Sync settings

Question 21

You have a Microsoft 365 E5 subscription that contains a user named User1.

User1 needs to be able to create Data Subject Requests (DSRs) in the Microsoft 365 compliance center.

To which role or role group should you add User1?

Options:

A.

the Compliance Data Administrator role

B.

the Data Investigator role

C.

the eDiscovery Manager role

D.

the Records Management role group

Question 22

You have a hybrid Microsoft 365 deployment that contains the users shown in the following table.

You need to perform an eDiscovery content search.

Which users data can be included in the content search? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 23

You have multiple Microsoft 365 subscriptions.

You need to build an application that will retrieve the Microsoft Secure Score data of each subscription.

What should you use?

Options:

A.

the Microsoft Defender for Endpoint API

B.

the Microsoft Graph Security API

C.

the Microsoft Office 365 Management API

D.

the Azure Monitor REST API

Question 24

You have a Microsoft 365 subscription.

You configure Microsoft Defender for Endpoint as shown in the following table.

You onboard devices to Microsoft Defender for Endpoint as shown in the following table.

Microsoft Defender for Endpoint contains the incidents shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Options:

Question 25

You have a Microsoft 365 subscription.

You create an Advanced Threat Protection (ATP) safe attachments policy to quarantine malware.

You need to configure the retention duration for the attachments in quarantine.

Which type of threat management policy should you create from the Security&Compliance admin center?

Options:

A.

ATP anti-phishing

B.

DKIM

C.

Anti-spam

D.

Anti-malware

Question 26

You need to recommend a solution that meets the technical and security requirements for sharing data with the partners.

What should you include in the recommendation? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Options:

A.

Create an access review.

B.

Assign the Global administrator role to User1.

C.

Assign the Guest inviter role to User1.

D.

Modify the External collaboration settings in the Azure Active Directory admin center.

Question 27

You need to recommend an email malware solution that meets the security requirements.

What should you include in the recommendation? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 28

You need to recommend a solution to protect the sign-ins of Admin1 and Admin2.

What should you include in the recommendation?

Options:

A.

a device compliance policy

B.

an access review

C.

a user risk policy

D.

a sign-in risk policy

Question 29

You plan to configure an access review to meet the security requirements for the workload administrators. You create an access review policy and specify the scope and a group.

Which other settings should you configure? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 30

You install Azure ATP sensors on domain controllers.

You add a member to the Domain Admins group. You view the timeline in Azure ATP and discover that information regarding the membership change is missing.

You need to meet the security requirements for Azure ATP reporting.

What should you configure? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 31

An administrator configures Azure AD Privileged Identity Management as shown in the following exhibit.

What should you do to meet the security requirements?

Options:

A.

Change the Assignment Type for Admin2 to Permanent

B.

From the Azure Active Directory admin center, assign the Exchange administrator role to Admin2

C.

From the Azure Active Directory admin center, remove the Exchange administrator role to Admin1

D.

Change the Assignment Type for Admin1 to Eligible

Question 32

You need to recommend a solution for the user administrators that meets the security requirements for auditing.

Which blade should you recommend using from the Azure Active Directory admin center?

Options:

A.

Sign-ins

B.

Azure AD Identity Protection

C.

Authentication methods

D.

Access review

Question 33

NO: 7

You need to resolve the issue that targets the automated email messages to the IT team.

Which tool should you run first?

Options:

A.

Synchronization Service Manager

B.

Azure AD Connect wizard

C.

Synchronization Rules Editor

D.

IdFix

Question 34

You need to create Group2.

What are two possible ways to create the group?

Options:

A.

an Office 365 group in the Microsoft 365 admin center

B.

a mail-enabled security group in the Microsoft 365 admin center

C.

a security group in the Microsoft 365 admin center

D.

a distribution list in the Microsoft 365 admin center

E.

a security group in the Azure AD admin center

Question 35

You need to enable and configure Microsoft Defender for Endpoint to meet the security requirements. What should you do?

Options:

A.

Configure port mirroring

B.

Create the ForceDefenderPassiveMode registry setting

C.

Download and install the Microsoft Monitoring Agent

D.

Run WindowsDefenderATPOnboardingScripc.cmd

Question 36

Which IP address space should you include in the MFA configuration?

Options:

A.

131.107.83.0/28

B.

192.168.16.0/20

C.

172.16.0.0/24

D.

192.168.0.0/20

Question 37

How should you configure Azure AD Connect? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 38

You need to implement Windows Defender ATP to meet the security requirements. What should you do?

Options:

A.

Configure port mirroring

B.

Create the ForceDefenderPassiveMode registry setting

C.

Download and install the Microsoft Monitoring Agent

D.

Run WindowsDefenderATPOnboardingScript.cmd

Question 39

How should you configure Group3? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 40

You need to create Group3.

What are two possible ways to create the group?

Options:

A.

an Office 365 group in the Microsoft 365 admin center

B.

a mail-enabled security group in the Microsoft 365 admin center

C.

a security group in the Microsoft 365 admin center

D.

a distribution list in the Microsoft 365 admin center

E.

a security group in the Azure AD admin center

Question 41

You need to configure threat detection for Active Directory. The solution must meet the security requirements.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Options:

Question 42

You are evaluating which finance department users will be prompted for Azure MFA credentials.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Options:

Question 43

Which user passwords will User2 be prevented from resetting?

Options:

A.

User6 and User7

B.

User4 and User6

C.

User4 only

D.

User7 and User8

E.

User8 only

Question 44

You need to meet the technical requirements for User9. What should you do?

Options:

A.

Assign the Privileged administrator role to User9 and configure a mobile phone number for User9

B.

Assign the Compliance administrator role to User9 and configure a mobile phone number for User9

C.

Assign the Security administrator role to User9

D.

Assign the Global administrator role to User9

Question 45

Which policies apply to which devices? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 46

Which users are members of ADGroup1 and ADGroup2? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 47

What should User6 use to meet the technical requirements?

Options:

A.

Supervision in the Security & Compliance admin center

B.

Service requests in the Microsoft 365 admin center

C.

Security & privacy in the Microsoft 365 admin center

D.

Data subject requests in the Security & Compliance admin center

Question 48

You are evaluating which devices are compliant in Intune.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Options:

Question 49

Which role should you assign to User1?

Options:

A.

Global administrator

B.

User administrator

C.

Privileged role administrator

D.

Security administrator

Demo: 49 questions
Total 327 questions