MS-500 Threat Protection & Security Operations

Question 1

Which Microsoft 365 Defender service protects against malicious links and attachments in email?

Accepted Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Office 365 provides Safe Links and Safe Attachments to protect users from malicious URLs and email attachments.

Question 2

What does Microsoft Defender for Identity primarily monitor?

Accepted Answer

On-premises Active Directory signals for identity-based attacks

Answer

Microsoft Defender for Identity monitors on-premises Active Directory activity to detect identity-based attacks like pass-the-hash and lateral movement.

Question 3

Which feature in Microsoft Defender for Office 365 detonates suspicious attachments in a sandbox before delivery?

Accepted Answer

Safe Attachments

Answer

Safe Attachments detonates email attachments in a virtual sandbox environment to check for malicious behavior before delivering them to users.

Question 4

An alert fires in Microsoft 365 Defender indicating a compromised user account. What is the first recommended action?

Accepted Answer

Disable the account and reset the password

Answer

When an account is suspected compromised, immediately disabling it and forcing a password reset stops the attacker while preserving the account for investigation.

Question 5

Which Microsoft 365 Defender portal provides a unified view of incidents across all Defender services?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com)

Answer

The Microsoft 365 Defender portal at security.microsoft.com aggregates incidents, alerts, and investigations from all Defender services into a single unified console.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Threat Protection & Security Operations