Microsoft 365 Security Administration (MS-500) — Questions and Answers

Question 1: An organization's compliance team needs to assess which Microsoft 365 compliance actions Microsoft manages versus which ones the customer must implement. Where is this information found?

Compliance Manager's shared responsibility model and action breakdown (Correct answer)
Microsoft Intune device compliance reports
Azure Policy definitions
Microsoft Defender for Cloud security recommendations

Correct answer: Compliance Manager's shared responsibility model and action breakdown

Compliance Manager displays a shared responsibility breakdown showing Microsoft-managed controls versus customer-managed improvement actions for each regulatory assessment.

Question 2: An organization must demonstrate compliance with GDPR regarding data subject access requests. Which Microsoft 365 tool allows administrators to find and export personal data for a specific individual?

Data Subject Request (DSR) tool in Microsoft Purview (Correct answer)
Microsoft Compliance Manager
Microsoft Defender for Identity
Azure AD User Audit Logs

Correct answer: Data Subject Request (DSR) tool in Microsoft Purview

Microsoft Purview provides a Data Subject Request tool that allows administrators to search for and export personal data related to a specific individual across Microsoft 365 services.

Question 3: A Microsoft 365 Security Administrator is responsible for maintaining a security operations playbook. What should the playbook include to meet professional standards?

A list of all security products in use
Step-by-step response procedures for common incident types, escalation paths, and tool references (Correct answer)
Only the contact details of the security team
Organizational charts and budget information

Correct answer: Step-by-step response procedures for common incident types, escalation paths, and tool references

A professional security playbook must include detailed procedural steps, decision trees for common incident types, escalation procedures, and references to the tools used in response.

Question 4: A security team receives pushback from HR about Microsoft Purview communication compliance monitoring policies covering HR conversations. What is the best resolution approach?

Exclude HR entirely from all compliance monitoring policies
Engage HR leadership and legal to define scope, exclusions, and oversight procedures collaboratively (Correct answer)
Escalate directly to the CEO without involving HR
Override HR objections and enforce full monitoring without modification

Correct answer: Engage HR leadership and legal to define scope, exclusions, and oversight procedures collaboratively

Communication compliance policies affecting HR require collaborative scoping with HR and legal to balance regulatory requirements with employee relations and legal constraints.

Question 5: You're working in a Microsoft 365 hybrid environment. Microsoft Intune is used to manage all of the PCs, which run Windows 10. Create a conditional access policy in Microsoft Azure Active Directory (Azure AD) that allows only Windows 10 computers marked as compliant to connect to the on-premises network through VPN. What should you start with?

From the Azure Active Directory admin center, configure authentication methods
From the Azure Active Directory admin center, create a new certificate (Correct answer)
Enable Application Proxy in Azure AD
From Active Directory Administrative Center, create a Dynamic Access Control policy

Correct answer: From the Azure Active Directory admin center, create a new certificate

To enable Conditional Access for VPN connections to an on-premises network, a certificate-based authentication method is typically required. Creating a new certificate in Azure AD allows for secure authentication and validation of device compliance. This ensures only compliant Windows 10 devices can establish a VPN connection, enhancing network security.

Question 6: A security team is conducting quality assurance on Microsoft 365 audit logging. Which audit log retention period requires a Microsoft 365 E5 or Advanced Audit add-on license?

30-day audit log retention
10-year audit log retention (Correct answer)
1-year audit log retention for all users
90-day audit log retention

Correct answer: 10-year audit log retention

The 10-year audit log retention option requires a Microsoft 365 E5 license or the Microsoft 365 Advanced Audit add-on to be assigned to users.

Question 7: How do MS-500 professionals build trust with clients or stakeholders?

Through competitive pricing only
Through marketing only
By always agreeing with clients
Through consistent competence, transparency, reliability, and ethical behavior (Correct answer)

Correct answer: Through consistent competence, transparency, reliability, and ethical behavior

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. Through consistent competence, transparency, reliability, and ethical behavior represents the professional standard for communication in the MS-500 certification framework.

Question 8: What is the role of DKIM (DomainKeys Identified Mail) in Microsoft 365 email security?

Encrypts the email body end-to-end
Enforces SPF record validation for inbound emails
Adds a cryptographic signature to outbound emails to verify the sending domain's authenticity (Correct answer)
Blocks phishing emails based on sender reputation

Correct answer: Adds a cryptographic signature to outbound emails to verify the sending domain's authenticity

DKIM adds a digital signature to outgoing emails, allowing receiving servers to verify the message was sent from the legitimate domain.

Question 9: During a security tabletop exercise, a participant asks who is responsible for approving emergency Conditional Access policy changes during an active attack. What should the security policy define?

All CA changes require a standard change management board meeting regardless of urgency
Microsoft support must approve all emergency Conditional Access modifications
A pre-designated break-glass authorization chain with at least two approvers from security leadership (Correct answer)
Any on-call engineer can make emergency CA changes independently without approval

Correct answer: A pre-designated break-glass authorization chain with at least two approvers from security leadership

Incident response procedures should define a pre-authorized emergency change path with multi-approver accountability to enable rapid response without bypassing governance.

Question 10: Under the Zero Trust model, which principle dictates that security should be applied regardless of whether a request originates inside or outside the corporate network?

Least privilege access
Verify explicitly
Use just-in-time access
Assume breach (Correct answer)

Correct answer: Assume breach

The 'Assume breach' principle of Zero Trust mandates designing security controls as if the network is already compromised, removing implicit trust based on network location.

Question 11: What severity level should an organization assign when configuring Microsoft 365 Defender alert policies for high-impact events?

Low
Informational
Medium
High (Correct answer)

Correct answer: High

High-severity alerts should be assigned to events with significant business impact such as mass file deletion or ransomware activity.

Question 12: Which regulation specifically mandates that organizations notify affected individuals within 72 hours of discovering a personal data breach?

PCI DSS
CCPA
GDPR (Correct answer)
HIPAA

Correct answer: GDPR

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Question 13: What is the primary purpose of regulatory compliance in MS-500 - Microsoft 365 Security Administration practice?

To limit competition
To protect public safety, ensure quality standards, and maintain professional accountability (Correct answer)
To create bureaucratic burden
To benefit regulators only

Correct answer: To protect public safety, ensure quality standards, and maintain professional accountability

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. To protect public safety, ensure quality standards, and maintain professional accountability represents the professional standard for regulatory in the MS-500 certification framework.

Question 14: You have a Microsoft 365 tenancy named contoso.com that is linked to a hybrid Azure Active Directory (Azure AD) tenant. For contoso.com, you must activate Azure AD Seamless Single Sign-On (Azure AD SSO). What type of material should you use?

the Microsoft 365 admin center
the Azure Active Directory admin center
Azure AD Connect (Correct answer)
the Microsoft 365 Security admin center

Correct answer: Azure AD Connect

Azure AD Seamless Single Sign-On (SSO) is enabled directly through the Azure AD Connect wizard during or after its initial configuration. This feature allows users to automatically sign in when their devices are connected to the corporate network. Azure AD Connect is responsible for synchronizing identities and configuring the necessary settings for Seamless SSO to function.

Question 15: A security analyst notices the organization's Secure Score dropped significantly overnight. Which Secure Score feature should they use to identify what changed?

Recommended score target
History tab (Correct answer)
Comparison tab
Improvement actions tab

Correct answer: History tab

The History tab in Secure Score shows score changes over time with explanations for each point gain or loss.

Question 16: How should MS-500 - Microsoft 365 Security Administration professionals handle conflicts with stakeholders?

Escalate immediately to management
Avoid all conflict
Address issues professionally through active listening, finding common ground, and seeking resolution (Correct answer)
Ignore stakeholder concerns

Correct answer: Address issues professionally through active listening, finding common ground, and seeking resolution

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. Address issues professionally through active listening, finding common ground, and seeking resolution represents the professional standard for communication in the MS-500 certification framework.

Question 17: Why is evidence-based practice important in MS-500 - Microsoft 365 Security Administration?

It integrates best available evidence with professional expertise for optimal outcomes (Correct answer)
It replaces experience
It is a theoretical concept only
It only applies to academic settings

Correct answer: It integrates best available evidence with professional expertise for optimal outcomes

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. It integrates best available evidence with professional expertise for optimal outcomes represents the professional standard for research in the MS-500 certification framework.

Question 18: Under GDPR, which Microsoft 365 tool allows an organization to respond to a Data Subject Request (DSR) to export a user's personal data?

Microsoft Purview Content Search (Correct answer)
Microsoft Defender for Endpoint
Microsoft 365 Compliance Score
Azure AD Identity Protection

Correct answer: Microsoft Purview Content Search

Microsoft Purview Content Search enables administrators to find and export content associated with a specific user to fulfill GDPR Data Subject Requests.

Question 19: Which professional responsibility does an MS-500 administrator have when they discover that a colleague has been granted excessive permissions to sensitive data without a documented business justification?

Monitor the colleague for 30 days before taking action
Remove the permissions immediately without notifying anyone
Request a new audit of all permissions across the tenant
Document the finding and escalate through the defined security governance process (Correct answer)

Correct answer: Document the finding and escalate through the defined security governance process

The professional standard is to document the finding and escalate through defined governance channels, ensuring accountability without unauthorized unilateral action.

Question 20: According to Microsoft's recommended practices, how often should Global Administrator role assignments be reviewed in a production Microsoft 365 tenant?

Every six months
Only when personnel changes occur
Monthly or more frequently (Correct answer)
Annually

Correct answer: Monthly or more frequently

Microsoft recommends reviewing Global Administrator assignments monthly or more frequently because this role has the highest level of privilege in the tenant.

Question 21: An organization wants to prevent users from forwarding emails to external addresses automatically. Which Microsoft 365 tool should be configured?

Microsoft Purview DLP
Exchange mail flow rules (transport rules) (Correct answer)
Safe Attachments policy
Azure AD Identity Protection

Correct answer: Exchange mail flow rules (transport rules)

Exchange transport rules can block automatic email forwarding to external recipients at the mail flow level.

Question 22: An organization is preparing for an ISO 27001 audit. The auditor asks for evidence that Microsoft 365 security controls are monitored continuously. Which Microsoft tool best provides this evidence?

Azure AD sign-in reports
Microsoft Compliance Manager with continuous assessment (Correct answer)
Microsoft Defender for Cloud Apps activity log
Microsoft Purview Audit with log retention set to 90 days

Correct answer: Microsoft Compliance Manager with continuous assessment

Microsoft Compliance Manager provides continuous compliance assessment with automated control testing evidence, directly supporting ISO 27001 audit requirements.

Question 23: What is the value of written documentation in MS-500 professional communication?

It is optional
It is only for formal occasions
It creates permanent records, ensures clarity, and provides legal protection (Correct answer)
It replaces verbal communication

Correct answer: It creates permanent records, ensures clarity, and provides legal protection

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. It creates permanent records, ensures clarity, and provides legal protection represents the professional standard for communication in the MS-500 certification framework.

Question 24: An organization needs to identify all documents containing credit card numbers stored across Microsoft 365. Which capability should be used?

Azure Security Center
Microsoft Defender for Cloud Apps
Microsoft 365 Audit Log
Microsoft Purview Content Explorer (Correct answer)

Correct answer: Microsoft Purview Content Explorer

Content Explorer in Microsoft Purview shows all items across Microsoft 365 that contain sensitive information types such as credit card numbers.

Question 25: Which regulation requires organizations to appoint a Data Protection Officer (DPO) when processing personal data at large scale, and how does Microsoft 365 support this role?

GDPR; through Compliance Manager role-based access allowing DPO review of assessments (Correct answer)
SOX; through the CFO sign-off workflow in Compliance Manager
PCI DSS; through the Qualified Security Assessor portal
HIPAA; through the Privacy Officer designation in the Admin Center

Correct answer: GDPR; through Compliance Manager role-based access allowing DPO review of assessments

GDPR requires a DPO for large-scale personal data processing; Compliance Manager supports this role by providing role-based access so DPOs can review compliance assessments without full admin rights.

Question 26: A financial services firm must comply with SEC Rule 17a-4 for immutable record retention. Which Microsoft 365 feature satisfies this requirement?

Microsoft Teams channel archiving
Azure AD Privileged Identity Management
SharePoint versioning
Microsoft Purview Retention Labels with Preservation Lock (Correct answer)

Correct answer: Microsoft Purview Retention Labels with Preservation Lock

Preservation Lock on Microsoft Purview retention policies ensures records cannot be deleted or modified before the retention period expires, satisfying SEC Rule 17a-4 WORM requirements.

Question 27: Which NIST Cybersecurity Framework function is being applied when a security team classifies data, inventories assets, and maps data flows in Microsoft 365?

Detect
Identify (Correct answer)
Respond
Protect

Correct answer: Identify

The NIST CSF 'Identify' function covers asset management, business environment analysis, governance, risk assessment, and risk management strategy.

Question 28: Which Android enrollment mode in Microsoft Intune creates a separate, encrypted work profile on a personally owned device to isolate corporate data from personal data?

Android Enterprise Fully Managed
Android Enterprise Work Profile (BYOD) (Correct answer)
Android Device Administrator (legacy)
Android Enterprise Dedicated Device

Correct answer: Android Enterprise Work Profile (BYOD)

Android Enterprise Work Profile creates an isolated, encrypted container for corporate apps and data, leaving personal data outside IT management scope.

Question 29: During an incident response exercise, the security team must contain a compromised user account. What is the correct sequence of initial containment steps in Microsoft 365?

Delete the account → revoke sessions → notify user
Reset password → enable MFA → review audit logs
Block sign-in → remove all licenses → open support ticket
Disable the account → revoke all active sessions → reset credentials → investigate (Correct answer)

Correct answer: Disable the account → revoke all active sessions → reset credentials → investigate

Best practice containment starts with disabling the account, then revoking active sessions to terminate access, followed by credential reset, and then investigation.

Question 30: A user is locked out because of a high-risk sign-in flag. Which action remediates this in Azure AD Identity Protection?

Delete and recreate the user account
Assign a new license to the user
Reset the user's password and require MFA re-registration (Correct answer)
Disable the user account temporarily

Correct answer: Reset the user's password and require MFA re-registration

Resetting a risky user's password and requiring MFA re-registration dismisses the user risk and restores their access.

Question 31: During a Microsoft 365 tenant migration, the security team discovers that guest users from an acquired company have excessive SharePoint permissions. Who should be the primary stakeholder to coordinate remediation?

End users who shared the SharePoint sites
Business unit owners who sponsor the guest relationships (Correct answer)
Microsoft support directly
The acquired company's IT administrator

Correct answer: Business unit owners who sponsor the guest relationships

Business unit owners who sponsor guest relationships are accountable for guest access decisions and must drive remediation to preserve business relationships while reducing risk.

Question 32: A healthcare organization wants Microsoft to notify them before any Microsoft support engineer accesses their Microsoft 365 content. Which feature enables this?

Conditional Access policies
Azure AD Just-In-Time access
Microsoft Purview Audit (Premium)
Customer Lockbox (Correct answer)

Correct answer: Customer Lockbox

Customer Lockbox ensures that Microsoft support engineers must request and receive customer approval before accessing customer content in Microsoft 365.

Question 33: In Compliance Manager, what does an 'improvement action' owned by Microsoft (as opposed to customer-owned) indicate?

The customer must implement the control manually
The action requires a Premium compliance license
The action is optional and can be skipped
Microsoft manages and is responsible for that control on behalf of all tenants (Correct answer)

Correct answer: Microsoft manages and is responsible for that control on behalf of all tenants

Microsoft-owned improvement actions are controls that Microsoft implements and manages in its infrastructure, contributing to your compliance score through the shared responsibility model.

Question 34: Which Microsoft 365 compliance feature helps organizations meet ISO 27001 requirements by mapping security controls to Microsoft service configurations?

Microsoft Intune compliance policies
Microsoft Purview Compliance Manager with ISO 27001 template (Correct answer)
Microsoft Defender XDR
Azure AD Identity Governance

Correct answer: Microsoft Purview Compliance Manager with ISO 27001 template

Compliance Manager provides an ISO 27001 assessment template that maps controls to Microsoft-managed and customer-managed actions across Microsoft 365 services.

Question 35: A company must demonstrate that sensitive emails containing PII are encrypted in transit and at rest to satisfy GDPR Article 32. Which feature addresses this?

Microsoft Purview Insider Risk Management
Azure AD Password Protection
Microsoft 365 Message Encryption (OME) with transport rules (Correct answer)
Microsoft Defender for Office 365 Safe Attachments

Correct answer: Microsoft 365 Message Encryption (OME) with transport rules

Office 365 Message Encryption applied via mail flow rules encrypts sensitive emails automatically, addressing GDPR Article 32's requirement for appropriate technical security measures.

Question 36: A company's Compliance Score in Microsoft Purview Compliance Manager dropped after a Microsoft service update. What does this most likely indicate?

A previously passing Microsoft-managed control no longer meets the assessment criteria (Correct answer)
A data breach was detected in the tenant
Admin MFA was disabled
A retention policy was deleted

Correct answer: A previously passing Microsoft-managed control no longer meets the assessment criteria

Compliance Score can decrease if a Microsoft-managed action's status changes due to service updates that affect how controls are assessed against regulatory requirements.

Question 37: An organization's security policy requires separation of duties for Exchange Online administration. Which configuration enforces this principle by requiring two administrators to approve sensitive actions?

Dual approval in Microsoft Purview Customer Lockbox
Conditional Access requiring two admin accounts to sign in simultaneously
Customer Lockbox is for Microsoft engineers, not internal admins — use Exchange Multi-Admin Approval (Four-Eyes Principle) via compliance policies
Privileged Access Management (PAM) in Microsoft Purview with approval workflow (Correct answer)

Correct answer: Privileged Access Management (PAM) in Microsoft Purview with approval workflow

Microsoft Purview Privileged Access Management enforces just-in-time, just-enough-access for privileged Exchange tasks with a required approval workflow, implementing separation of duties.

Question 38: How do continuing education requirements benefit MS-500 certified professionals?

They ensure professionals stay current with evolving industry practices and knowledge (Correct answer)
They reduce practical skills
They are unnecessary formalities
They only benefit training providers

Correct answer: They ensure professionals stay current with evolving industry practices and knowledge

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. They ensure professionals stay current with evolving industry practices and knowledge represents the professional standard for professional standards in the MS-500 certification framework.

Question 39: When a sensitivity label applies automatic encryption, which permission allows a recipient to read a document but not forward or copy it?

Co-Author
Viewer (Correct answer)
Reviewer
Co-Owner

Correct answer: Viewer

The Viewer permission level in Azure RMS grants only the rights to view content, preventing forwarding, copying, printing, or editing.

Question 40: Under the California Consumer Privacy Act (CCPA), what right do California residents have that organizations must fulfill using Microsoft 365 tools?

Right to multi-factor authentication
Right to know what personal information is collected and to request deletion (Correct answer)
Right to encryption of all stored data
Right to audit all administrator actions

Correct answer: Right to know what personal information is collected and to request deletion

CCPA grants California residents the right to know what personal data is collected about them and to request its deletion, which can be fulfilled using Microsoft Purview DSR tools.

Question 41: You're a subscriber to Microsoft 365. You must recommend a biometric authentication method that does not require a password. What should your advice include?

the Microsoft Authenticator app
Windows Hello for Business (Correct answer)
a PIN
a smart card

Correct answer: Windows Hello for Business

Windows Hello for Business provides strong, passwordless authentication using biometrics (facial recognition or fingerprint) or a PIN. It integrates directly with Microsoft 365 and Azure AD, allowing users to sign in to their devices and access resources without needing to type a password. This enhances security and user convenience by eliminating password-related vulnerabilities.

Question 42: Which Microsoft 365 audit log event type is most important for demonstrating compliance with HIPAA's Audit Controls standard (§164.312(b))?

Microsoft Intune device enrollment logs
Sensitivity label activity reports
Unified audit log entries including access to mailboxes containing PHI (Correct answer)
Azure AD sign-in logs showing successful logins only

Correct answer: Unified audit log entries including access to mailboxes containing PHI

HIPAA §164.312(b) requires audit controls to record and examine activity in information systems containing PHI; unified audit logs capturing mailbox and SharePoint access achieve this.

Question 43: Microsoft Defender for Identity (MDI) primarily analyzes which data source to detect lateral movement and identity-based attacks on-premises?

SharePoint file access logs
Azure AD sign-in logs
Domain controller event logs and network traffic (Correct answer)
Exchange Online mail flow logs

Correct answer: Domain controller event logs and network traffic

MDI sensors installed on domain controllers analyze Windows Event Logs and network traffic to detect attacks like Pass-the-Hash and Kerberoasting.

Question 44: A security administrator is required to attest quarterly that all privileged roles in Azure AD are still necessary. Which feature enforces this requirement?

Access Reviews in Azure AD Identity Governance (Correct answer)
Azure AD Entitlement Management
Privileged Identity Management alerts
Conditional Access Policies

Correct answer: Access Reviews in Azure AD Identity Governance

Azure AD Identity Governance Access Reviews allow administrators or resource owners to periodically certify that privileged role assignments remain appropriate.

Question 45: An admin is assessing the quality of DLP policies. Which Microsoft Purview feature provides a report showing how many DLP policy matches occurred and which policy triggered them?

Audit log search
Microsoft 365 Message Trace
Microsoft Defender for Cloud Apps activity log
DLP policy reports in the compliance portal (Correct answer)

Correct answer: DLP policy reports in the compliance portal

The Microsoft Purview compliance portal provides DLP reports that show policy match counts, rules triggered, and affected content.

Question 46: A risk assessment identifies that admins are using permanent Global Administrator roles. Which Microsoft 365 control directly reduces this privileged identity risk?

Multi-factor authentication (MFA)
Microsoft Defender for Identity
Security defaults
Privileged Identity Management (PIM) with just-in-time access (Correct answer)

Correct answer: Privileged Identity Management (PIM) with just-in-time access

PIM provides just-in-time privileged access, requiring admins to activate elevated roles with approval and time limits, reducing the window of exposure from standing privileged accounts.

Question 47: A security team is building a RACI matrix for Microsoft 365 security responsibilities. What does the 'A' (Accountable) designation mean in this context?

The person who approves decisions and is answerable for the outcome (Correct answer)
The person who performs the task
The person who receives status updates
The person who provides input or expertise

Correct answer: The person who approves decisions and is answerable for the outcome

In a RACI matrix, 'Accountable' designates the single person who is ultimately answerable for the correct completion of the task and has decision-making authority.

Question 48: When BitLocker is enabled and managed through Microsoft Intune on a Windows device, where are BitLocker recovery keys stored for administrator retrieval?

Sent to the user's email address automatically
On the local device in a protected system folder
Escrowed to Azure Active Directory (Azure AD) and visible in Intune (Correct answer)
Stored on a USB key designated by the admin

Correct answer: Escrowed to Azure Active Directory (Azure AD) and visible in Intune

Intune automatically escrows BitLocker recovery keys to Azure AD, allowing administrators to retrieve them from the Intune admin center or Azure AD device properties.

Question 49: When documenting a Microsoft 365 Data Loss Prevention policy for a regulatory audit, which element is MOST important to include?

Only the technical DLP rule conditions and actions in JSON format
A list of all users who triggered DLP policy matches
The Microsoft product version the DLP policy was created in
Business justification, regulatory requirement mapped, policy scope, exceptions, and approval chain (Correct answer)

Correct answer: Business justification, regulatory requirement mapped, policy scope, exceptions, and approval chain

Regulatory auditors need policy documentation that traces the rule back to a regulatory requirement with clear ownership, scope, and governance approval.

Question 50: When an Intune-managed device is marked as non-compliant, what typically happens when Conditional Access policies are enforced?

The device is immediately wiped remotely
An SMS alert is sent to the device user
The user is blocked from accessing corporate resources (Correct answer)
The device is automatically remediated and marked compliant

Correct answer: The user is blocked from accessing corporate resources

Conditional Access evaluates compliance status and blocks non-compliant devices from accessing corporate resources such as Exchange Online and SharePoint.

Question 51: A Microsoft 365 security administrator is asked to justify the cost of Microsoft Defender for Office 365 Plan 2 to finance leadership. Which argument is MOST compelling?

Demonstrate the cost of a single ransomware incident versus the annual license cost (Correct answer)
List all technical features included in the license tier
Show the Microsoft product roadmap for future feature additions
Compare the number of API calls available vs. Plan 1

Correct answer: Demonstrate the cost of a single ransomware incident versus the annual license cost

Finance stakeholders respond to ROI arguments — comparing potential breach costs against license fees directly frames security as a financial risk mitigation investment.

Question 52: What is the primary competency framework for MS-500 - Microsoft 365 Security Administration professionals?

Ad-hoc skill development
Employer-specific requirements only
Structured competency standards defined by the certifying body (Correct answer)
Self-assessed capabilities only

Correct answer: Structured competency standards defined by the certifying body

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. Structured competency standards defined by the certifying body represents the professional standard for professional standards in the MS-500 certification framework.

Question 53: What is the primary purpose of Microsoft Secure Score?

To provide a quantified security posture rating with recommended improvement actions (Correct answer)
To track user productivity metrics
To audit Azure resource costs
To measure network bandwidth utilization

Correct answer: To provide a quantified security posture rating with recommended improvement actions

Microsoft Secure Score quantifies an organization's security posture and suggests prioritized actions to improve it.

Question 54: What is the significance of a code of conduct for MS-500 professionals?

It applies only to new practitioners
It establishes expected behaviors and ethical standards that protect the public and profession (Correct answer)
It limits professional freedom
It is merely symbolic

Correct answer: It establishes expected behaviors and ethical standards that protect the public and profession

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. It establishes expected behaviors and ethical standards that protect the public and profession represents the professional standard for professional standards in the MS-500 certification framework.

Question 55: How should MS-500 professionals prioritize identified risks?

By cost to mitigate only
Based on likelihood of occurrence combined with severity of potential impact (Correct answer)
Randomly
Alphabetically

Correct answer: Based on likelihood of occurrence combined with severity of potential impact

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. Based on likelihood of occurrence combined with severity of potential impact represents the professional standard for risk management in the MS-500 certification framework.

Question 56: In Microsoft Defender Vulnerability Management, what information is provided for each identified vulnerability to guide remediation?

User behavioral analytics scores
CVE details, affected devices count, and remediation guidance (Correct answer)
Compliance assessment scores
Email threat intelligence summaries

Correct answer: CVE details, affected devices count, and remediation guidance

Defender Vulnerability Management surfaces CVE-specific details including severity, exposed devices, and actionable remediation steps prioritized by exposure.

Question 57: When conducting a Microsoft 365 security assessment, an administrator uses Microsoft Secure Score. What best describes what a Secure Score improvement action represents?

A mandatory compliance regulation that must be met
A vulnerability that has been actively exploited
An automated remediation that has already been applied
A recommended security configuration change with an associated score impact (Correct answer)

Correct answer: A recommended security configuration change with an associated score impact

Secure Score improvement actions are prioritized security recommendations; each has an associated point value reflecting its relative security impact if implemented.

Question 58: An admin wants to block downloads of sensitive files from unmanaged devices in real time. Which feature enables this?

Safe Attachments policy
Data Loss Prevention policy
Microsoft Defender for Endpoint
Conditional Access App Control in Defender for Cloud Apps (Correct answer)

Correct answer: Conditional Access App Control in Defender for Cloud Apps

Conditional Access App Control uses reverse proxy to monitor and control session activity in real time, including blocking downloads on unmanaged devices.

Question 59: The security team wants to communicate the results of a Microsoft 365 Secure Score improvement initiative over a quarter. Which visualization best conveys progress to executive stakeholders?

A technical firewall rule change log
A trend line chart showing Secure Score percentage change over the quarter with milestone annotations (Correct answer)
A raw table of all 150+ recommended actions and their completion status
A list of all Azure AD conditional access policy JSON configurations

Correct answer: A trend line chart showing Secure Score percentage change over the quarter with milestone annotations

Executive stakeholders need high-level trend visualization with context, not raw technical data — a trend line with milestone annotations conveys progress clearly.

Question 60: A project manager asks the Microsoft 365 security administrator to disable eDiscovery holds on a departed employee's mailbox to free up storage. What should the administrator communicate?

eDiscovery holds automatically expire after 30 days and no action is needed
Only the departed employee can authorize removal of their mailbox hold
Holds cannot be removed without legal counsel approval because active litigation or compliance requirements may mandate retention (Correct answer)
Storage optimization is sufficient justification to remove eDiscovery holds immediately

Correct answer: Holds cannot be removed without legal counsel approval because active litigation or compliance requirements may mandate retention

eDiscovery holds are placed for legal or compliance reasons, and removing them without legal counsel review risks spoliation of evidence or regulatory violations.

Microsoft 365 Security Administration (MS-500)

The MS-500 exam validates skills in planning, implementing, managing, and monitoring security and compliance solutions for Microsoft 365 and hybrid environments, covering identity and access, threat protection, information protection, and compliance governance.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds