MS-500 Threat Protection & Security Operations

Question 1

Which Microsoft 365 Defender service protects against malicious links and attachments in email?

Accepted Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 2

What does Microsoft Defender for Identity primarily monitor?

Accepted Answer

On-premises Active Directory signals for identity-based attacks

Answer

Cloud app usage and shadow IT

Answer

Endpoint behaviors for malware

Answer

Email for phishing campaigns

Question 3

Which feature in Microsoft Defender for Office 365 detonates suspicious attachments in a sandbox before delivery?

Accepted Answer

Safe Attachments

Answer

Safe Links

Answer

Anti-phishing policies

Answer

Mail flow rules

Question 4

An alert fires in Microsoft 365 Defender indicating a compromised user account. What is the first recommended action?

Accepted Answer

Disable the account and reset the password

Answer

Delete the user account immediately

Answer

Increase the user's MFA requirements

Answer

Review the user's OneDrive files

Question 5

Which Microsoft 365 Defender portal provides a unified view of incidents across all Defender services?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com)

Answer

Microsoft Purview compliance portal

Answer

Azure Security Center

Answer

Microsoft Endpoint Manager

Question 6

What is the purpose of Attack Simulation Training in Microsoft Defender for Office 365?

Accepted Answer

Run simulated phishing campaigns to train users to recognize attacks

Answer

Automatically block phishing emails before delivery

Answer

Scan email for malware signatures

Answer

Test firewall rules against known attack patterns