Holen Sie sich die aktuellsten MS-500-Prüfungsfragen zur Vorbereitung auf die Microsoft 365-Sicherheitsverwaltungsprüfung

1. Which role should you assign to User1?

2. You have a Microsoft 365 subscription.

You create an Advanced Threat Protection (ATP) safe attachments policy to quarantine malware.

You need to configure the retention duration for the attachments in quarantine.

Which type of threat management policy should you create from the Security&Compliance admin center?

3. Your network contains an on-premises Active Directory domain. The domain contains servers that run Windows Server and have advanced auditing enabled.

The security logs of the servers are collected by using a third-party SIEM solution.

You purchase a Microsoft 365 subscription and plan to deploy Azure Advanced Threat Protection (ATP) by using standalone sensors.

You need to ensure that you can detect when sensitive groups are modified and when malicious services are created.

What should you do?

4. HOTSPOT

You configure Microsoft Azure Active Directory (Azure AD) Connect as shown in the following exhibit.





Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

5. Which IP address space should you include in the MFA configuration?

6. HOTSPOT

You are evaluating which finance department users will be prompted for Azure MFA credentials.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

7. A user stores the following files in Microsoft OneDrive:

✑ File.docx

✑ ImportantFile.docx

✑ File_Important.docx

You create a Microsoft Cloud App Security file policy Policy1 that has the filter shown in the following exhibit.





To which files does Policy1 apply?

8. You have an Azure Active Directory (Azure AD) tenant that has a Microsoft 365 subscription You recently configured the tenant to require multi factor authentication (MFA) for risky sign ins You need to review the users who required MFA.

What should you do?

9. You create a data loss prevention (DLP) policy as shown in the following shown:





What is the effect of the policy when a user attempts to send an email messages that contains sensitive information?

10. You have a Microsoft 365 subscription.

A security manager receives an email message every time a data loss prevention (DLP) policy match occurs.

You need to limit alert notifications to actionable DLP events.

What should you do?

11. You need to implement Windows Defender ATP to meet the security requirements.

What should you do?

12. CORRECT TEXT

You need to ensure that all users must change their password every 100 days.

To complete this task, sign in to the Microsoft 365 portal.

13. You have a Microsoft 365 subscription.

Some users access Microsoft SharePoint Online from unmanaged devices.

You need to prevent the users from downloading, printing, and synching files.

What should you do?

14. You have a Microsoft 365 E5 subscription that contains the users shown in the following table.





You need to identify which user can enable Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) roles.

Which user should you identify?

15. You have a Microsoft 365 subscription that contains 100 users and a Microsoft 365 group named Group1.

All users have Windows 10 devices and use Microsoft SharePoint Online and Exchange Online.

A sensitivity label named Label1 is published as the default label for Group1.

You add two sublabels named Sublabel1 and Sublabel2 to Label1.

You need to ensure that the settings in Sublabel1 are applied by default to Group1.

What should you do?

16. You have a Microsoft 365 subscription.

You need to ensure that users can manually designate which content will be subject to data loss prevention (DLP) policies.

What should you create first?

17. CORRECT TEXT

Please wait while the virtual machine loads. Once loaded, you may proceed to the lab section. This may take a few minutes, and the wait time will not be deducted from your overall test time.

When the Next button is available, click it to access the lab section. In this section, you will perform a set of tasks in a live environment. While most functionality will be available to you as it would be in a live environment, some functionality (e.g., copy and paste, ability to navigate to external websites) will not be possible by design.

Scoring is based on the outcome of performing the tasks stated in the lab. In other words, it doesn’t matter how you accomplish the task, if you successfully perform it, you will earn credit for that task.

Labs are not timed separately, and this exam may more than one lab that you must complete. You can use as much time as you would like to complete each lab. But, you should manage your time appropriately to ensure that you are able to complete the lab(s) and all other sections of the exam in the time provided.

Please note that once you submit your work by clicking the Next button within a lab, you will NOT be able to return to the lab.



Username and password





Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Microsoft 365 Username:

admin@[email protected]

Microsoft 365 Password: #HSP.ug?$p6un

If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

The following information is for technical support only:

Lab instance: 11122308





































You need to protect against phishing attacks. The solution must meet the following requirements:

✑ Phishing email messages must be quarantined if the messages are sent from a spoofed domain.

✑ As many phishing email messages as possible must be identified.

The solution must apply to the current SMTP domain names and any domain names added later.

To complete this task, sign in to the Microsoft 365 admin center.

18. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some questions sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an on-premises Active Directory domain named contoso.com.

You install and run Azure AD Connect on a server named Server1 that runs Windows Server.

You need to view Azure AD Connect events.

You use the Directory Service event log on Server1.

Does that meet the goal?

19. You need to create Group3.

What are two possible ways to create the group?

20. HOTSPOT

You have a Microsoft 365 subscription.

You are creating a retention policy named Retention1 as shown in the following exhibit.





You apply Retention1 to SharePoint sites and OneDrive accounts.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

21. HOTSPOT

You have a Microsoft Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table.





You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings:

✑ Assignments: Include Group1, Exclude Group2

✑ Conditions: Sign in risk of Low and above

✑ Access: Allow access, Require password multi-factor authentication

You need to identify how the policy affects User1 and User2.

What occurs when each user signs in from an anonymous IP address? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

22. HOTSPOT

You have a Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) deployment that has the custom network indicators turned on.

Microsoft Defender ATP protects two computers that run Windows 10 as shown in the following table.





Microsoft Defender ATP has the machine groups shown in the following table.





From Microsoft Defender Security Center, you create the URLs/Domains indicators shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

23. You have a Microsoft 365 E5 subscription that contains a user named User1.

The Azure Active Directory (Azure AD) Identity Protection risky users report identities User1.

For User1, you select Confirm user compromised.

User1 can still sign in.

You need to prevent User1 from signing in. The solution must minimize the impact on users at a lower risk level.

Solution: You configure the user risk policy to block access when the user risk level is high.

Does this meet the goal?

24. HOTSPOT

You have a Microsoft 365 subscription.

You identify the following data loss prevention (DLP) requirements:

✑ Send notifications to users if they attempt to send attachments that contain EU social security numbers

✑ Prevent any email messages that contain credit card numbers from being sent outside your organization

✑ Block the external sharing of Microsoft OneDrive content that contains EU passport numbers

✑ Send administrators email alerts if any rule matches occur.

What is the minimum number of DLP policies and rules you must create to meet the requirements? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

25. Topic 3, Contoso, Ltd



This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.



To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.



At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.



To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.



Overview

Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York.

The company has the offices shown in the following table.







Contoso has IT, human resources (HR), legal, marketing, and finance departments. Contoso uses Microsoft 365.



Existing Environment

Infrastructure

The network contains an Active Directory domain named contoso.com that is synced to a Microsoft Azure Active Directory (Azure AD) tenant. Password writeback is enabled.

The domain contains servers that run Windows Server 2016. The domain contains laptops and desktop computers that run Windows 10 Enterprise.

Each client computer has a single volume.

Each office connects to the Internet by using a NAT device.

The offices have the IP addresses shown in the following table.





Named locations are defined in Azure AD as shown in the following table.







From the Multi-Factor Authentication page, an address space of 198.35.3.0/24 is defined in the trusted IPs list.

Azure Multi-Factor Authentication (MFA) is enabled for the users in the finance department.

The tenant contains the users shown in the following table.







The tenant contains the groups shown in the following table.







Customer Lockbox is enabled in Microsoft 365.



Microsoft Intune Configuration

The devices enrolled in Intune are configured as shown in the following table.





The device compliance policies in Intune are configured as shown in the following table.





The device compliance policies have the assignments shown in the following table.





The Mark devices with no compliance policy assigned as setting is set to Compliant.



Requirements

Technical Requirements

Contoso identifies the following technical requirements:

✑ Use the principle of least privilege

✑ Enable User1 to assign the Reports reader role to users

✑ Ensure that User6 approves Customer Lockbox requests as quickly aspossible

✑ Ensure that User9 can implement Azure AD Privileged Identity Management



HOTSPOT

You are evaluating which devices are compliant in Intune.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.