What distinguishes quality assurance from quality control in MS-500 - Microsoft 365 Security Administration practice?