MS-500 Test 1 — Questions and Answers
Question 1: You're a subscriber to Microsoft 365. <br> <br> You must recommend a biometric authentication method that does not require a password. <br> <br> What should your advice include?
- the Microsoft Authenticator app
- Windows Hello for Business (Correct answer)
- a PIN
- a smart card
Correct answer: Windows Hello for Business
Windows Hello for Business provides strong, passwordless authentication using biometrics (facial recognition or fingerprint) or a PIN. It integrates directly with Microsoft 365 and Azure AD, allowing users to sign in to their devices and access resources without needing to type a password. This enhances security and user convenience by eliminating password-related vulnerabilities.
Question 2: You have an on-premises Active Directory domain and a Microsoft 365 subscription on your network. <br> <br> You want to set up a hybrid Azure Active Directory (Azure AD) tenancy with Azure Active Directory Identity Protection risk policies enabled. <br> <br> To support the planned deployment, you must configure Azure AD Connect. <br> <br> Which authentication mechanism for Azure AD Connect should you use?
- Federation with PingFederate
- Pass-through authentication
- Federation with AD FS
- Password Hash Synchronization (Correct answer)
Correct answer: Password Hash Synchronization
Password Hash Synchronization (PHS) is the simplest method for synchronizing on-premises Active Directory passwords to Azure AD. It's compatible with Azure AD Identity Protection risk policies because it stores a hash of the password hash in Azure AD, allowing cloud-based threat detection. Unlike other methods, PHS doesn't rely on on-premises infrastructure for authentication, making it resilient and suitable for Identity Protection.
Question 3: You have a number of Conditional Access policies in place that prevent noncompliant devices from accessing services. <br> You'll need to figure out which policies are blocking particular devices. <br> What type of material should you use?
- Sign-ins in the Azure Active Directory admin center (Correct answer)
- Activity log in the Cloud App Security admin center
- Audit logs in the Azure Active Directory admin center
- the Setting compliance report in the Microsoft Endpoint Manager admin center
Correct answer: Sign-ins in the Azure Active Directory admin center
The Sign-ins logs in the Azure Active Directory admin center provide detailed information about every sign-in attempt, including which Conditional Access policies were applied and their outcome. This log is crucial for troubleshooting, as it clearly indicates if a policy blocked a device or user, and why. It allows administrators to identify the specific policy causing access issues for noncompliant devices.
Question 4: You're working in a Microsoft 365 hybrid environment. Microsoft Intune is used to manage all of the PCs, which run Windows 10. <br> Create a conditional access policy in Microsoft Azure Active Directory (Azure AD) that allows only Windows 10 computers marked as compliant to connect to the on-premises network through VPN. <br> What should you start with?
- From Active Directory Administrative Center, create a Dynamic Access Control policy
- From the Azure Active Directory admin center, create a new certificate (Correct answer)
- From the Azure Active Directory admin center, configure authentication methods
- Enable Application Proxy in Azure AD
Correct answer: From the Azure Active Directory admin center, create a new certificate
To enable Conditional Access for VPN connections to an on-premises network, a certificate-based authentication method is typically required. Creating a new certificate in Azure AD allows for secure authentication and validation of device compliance. This ensures only compliant Windows 10 devices can establish a VPN connection, enhancing network security.
Question 5: You are a subscriber to Microsoft 365 E5. <br> You must guarantee that users with the Exchange administrator role have time-limited rights and must request authorization using multi-factor authentication (MFA). <br> What method should you employ in order to reach your objective?
- Microsoft Azure AD group management
- Security & Compliance permissions
- Microsoft Azure Active Directory (Azure AD) Privileged Identity Management (Correct answer)
- Microsoft Office 365 user management
Correct answer: Microsoft Azure Active Directory (Azure AD) Privileged Identity Management
Azure AD Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources. It enables just-in-time access for administrative roles, meaning users are granted elevated permissions only when needed and for a limited time. PIM also enforces multi-factor authentication for activation of these roles, significantly enhancing security for high-privilege accounts like Exchange administrators.
Question 6: You're a subscriber to Microsoft 365. <br> You can create a new user via the Microsoft 365 admin center. <br> You intend to give the user the Reports reader role. <br> The permissions of the Reports reader role must be viewed. <br> Which administrative center should you go with?
- Microsoft 365
- Security & Compliance
- Cloud App Security
- Azure Active Directory (Correct answer)
Correct answer: Azure Active Directory
While users can be created and roles assigned in the Microsoft 365 admin center, the detailed permissions associated with specific Azure AD roles, such as the Reports reader role, are managed and viewed within the Azure Active Directory admin center. This is the central hub for identity and access management in Microsoft 365, providing granular control and visibility over role definitions.
Question 7: You have a Microsoft 365 tenancy named contoso.com that is linked to a hybrid Azure Active Directory (Azure AD) tenant. <br> <br> For contoso.com, you must activate Azure AD Seamless Single Sign-On (Azure AD SSO). <br> <br> What type of material should you use?
- the Azure Active Directory admin center
- Azure AD Connect (Correct answer)
- the Microsoft 365 admin center
- the Microsoft 365 Security admin center
Correct answer: Azure AD Connect
Azure AD Seamless Single Sign-On (SSO) is enabled directly through the Azure AD Connect wizard during or after its initial configuration. This feature allows users to automatically sign in when their devices are connected to the corporate network. Azure AD Connect is responsible for synchronizing identities and configuring the necessary settings for Seamless SSO to function.
Question 8: Microsoft Azure Advanced Threat Protection is used by your organisation (ATP). For an Azure ATP sensor named Sensor1, you enable the delayed release of updates. When will Sensor1 be updated after the Azure ATP cloud service is updated?
- 1 hour
- 48 hours
- 24 hours (Correct answer)
- 12 hours
Correct answer: 24 hours
When the 'delayed release of updates' option is enabled for an Azure ATP (now Microsoft Defender for Identity) sensor, it means the sensor will receive updates 24 hours after the Azure ATP cloud service is updated. This delay allows for a staggered deployment, providing a buffer period to observe the stability of updates before they are applied to all sensors.
Question 9: Your Microsoft 365 environment is a mix of the two. <br> Microsoft Office 365 ProPlus is installed on all machines, which runs Windows 10 Enterprise. Every one of <br> Active Directory is installed on PCs. <br> Server1 is a Windows Server 2016 server that you have. The telemetry database is stored on Server 1. You must prohibit Microsoft from receiving personal information from telemetry data. <br> What's your plan?
- Configure a registry on Server1
- On Server1, run readinessreportcreator.exe
- On the computers, run tdadm.exe
- Configure a registry on the computers (Correct answer)
Correct answer: Configure a registry on the computers
To prevent Microsoft from receiving personal information from telemetry data generated by Office 365 ProPlus, a registry setting needs to be configured directly on the client computers running Office. This setting allows administrators to control the level of diagnostic data sent to Microsoft. Modifying the registry on individual machines ensures that the policy is applied at the source of the telemetry data.
MS-500 Test 1
You're a subscriber to Microsoft 365.
You must recommend a biometric authentication method that does not require a password.
What should your advice include?