MS-500 Test 1

Question 1

You're a subscriber to Microsoft 365.

You must recommend a biometric authentication method that does not require a password.

What should your advice include?

Accepted Answer

Windows Hello for Business

Answer

Windows Hello for Business provides strong, passwordless authentication using biometrics (facial recognition or fingerprint) or a PIN. It integrates directly with Microsoft 365 and Azure AD, allowing users to sign in to their devices and access resources without needing to type a password. This enhances security and user convenience by eliminating password-related vulnerabilities.

Question 2

You have an on-premises Active Directory domain and a Microsoft 365 subscription on your network.

You want to set up a hybrid Azure Active Directory (Azure AD) tenancy with Azure Active Directory Identity Protection risk policies enabled.

To support the planned deployment, you must configure Azure AD Connect.

Which authentication mechanism for Azure AD Connect should you use?

Accepted Answer

Password Hash Synchronization

Answer

Password Hash Synchronization (PHS) is the simplest method for synchronizing on-premises Active Directory passwords to Azure AD. It's compatible with Azure AD Identity Protection risk policies because it stores a hash of the password hash in Azure AD, allowing cloud-based threat detection. Unlike other methods, PHS doesn't rely on on-premises infrastructure for authentication, making it resilient and suitable for Identity Protection.

Question 3

You have a number of Conditional Access policies in place that prevent noncompliant devices from accessing services.
You'll need to figure out which policies are blocking particular devices.
What type of material should you use?

Accepted Answer

Sign-ins in the Azure Active Directory admin center

Answer

The Sign-ins logs in the Azure Active Directory admin center provide detailed information about every sign-in attempt, including which Conditional Access policies were applied and their outcome. This log is crucial for troubleshooting, as it clearly indicates if a policy blocked a device or user, and why. It allows administrators to identify the specific policy causing access issues for noncompliant devices.

Question 4

You're working in a Microsoft 365 hybrid environment. Microsoft Intune is used to manage all of the PCs, which run Windows 10.
Create a conditional access policy in Microsoft Azure Active Directory (Azure AD) that allows only Windows 10 computers marked as compliant to connect to the on-premises network through VPN.
What should you start with?

Accepted Answer

From the Azure Active Directory admin center, create a new certificate

Answer

To enable Conditional Access for VPN connections to an on-premises network, a certificate-based authentication method is typically required. Creating a new certificate in Azure AD allows for secure authentication and validation of device compliance. This ensures only compliant Windows 10 devices can establish a VPN connection, enhancing network security.

Question 5

You are a subscriber to Microsoft 365 E5.
You must guarantee that users with the Exchange administrator role have time-limited rights and must request authorization using multi-factor authentication (MFA).
What method should you employ in order to reach your objective?

Accepted Answer

Microsoft Azure Active Directory (Azure AD) Privileged Identity Management

Answer

Azure AD Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources. It enables just-in-time access for administrative roles, meaning users are granted elevated permissions only when needed and for a limited time. PIM also enforces multi-factor authentication for activation of these roles, significantly enhancing security for high-privilege accounts like Exchange administrators.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Test 1