MS-500 Threat Protection & Security Operations 2

Question 1

Which Microsoft Defender for Cloud Apps feature discovers unsanctioned cloud applications used by employees?

Accepted Answer

Cloud Discovery

Answer

Cloud Discovery analyzes network traffic logs to identify cloud apps being used by employees, revealing shadow IT in the organization.

Question 2

An admin wants to block downloads of sensitive files from unmanaged devices in real time. Which feature enables this?

Accepted Answer

Conditional Access App Control in Defender for Cloud Apps

Answer

Conditional Access App Control uses reverse proxy to monitor and control session activity in real time, including blocking downloads on unmanaged devices.

Question 3

What severity level should an organization assign when configuring Microsoft 365 Defender alert policies for high-impact events?

Accepted Answer

High

Answer

High-severity alerts should be assigned to events with significant business impact such as mass file deletion or ransomware activity.

Question 4

Which capability in Microsoft 365 Defender automates investigation and remediation of common threats?

Accepted Answer

Automated Investigation and Remediation (AIR)

Answer

Automated Investigation and Remediation (AIR) automatically investigates alerts and takes remediation actions such as removing malicious emails or isolating devices.

Question 5

Which query language is used in Advanced Hunting within Microsoft 365 Defender?

Accepted Answer

Kusto Query Language (KQL)

Answer

Advanced Hunting uses Kusto Query Language (KQL) to search across 30 days of raw event data for threats and suspicious activity.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Threat Protection & Security Operations 2