Mixed Deck — All MS-500 Topics Flashcards

Azure AD Password Protection prevents users from using which types of passwords?

Answer: Passwords on a customizable banned password list including common weak passwords

Azure AD Password Protection uses a global and custom banned password list to prevent users from setting commonly used or organization-specific weak passwords.

How do MS-500 professionals evaluate research quality?

Answer: By assessing methodology, sample size, peer review status, and relevance to practice

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. By assessing methodology, sample size, peer review status, and relevance to practice represents the professional standard for research in the MS-500 certification framework.

Which Microsoft Defender for Endpoint capability allows a security analyst to isolate a compromised device from the network while keeping the management channel active?

Answer: Network Isolation (Contain Device)

Network Isolation (Contain Device) cuts off all network connections except the Defender for Endpoint management channel, keeping investigative access intact.

What is required before sensitivity labels can be applied by end users in Microsoft 365 Apps?

Answer: Publishing the labels via a label policy to users or groups

Sensitivity labels must be published through a label policy that targets specific users or groups before users can see and apply them in Microsoft 365 Apps.

Which tool is commonly used for root cause analysis in MS-500 quality management?

Answer: Fishbone (Ishikawa) diagram to identify contributing factors systematically

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. Fishbone (Ishikawa) diagram to identify contributing factors systematically represents the professional standard for quality in the MS-500 certification framework.

You must offer a solution for the user administrators that satisfies the auditing security criteria. Which blade from the Azure Active Directory admin center should you recommend?

Answer: Sign-ins

The 'Sign-ins' blade in the Azure Active Directory admin center is essential for auditing security criteria related to user administrators. It provides a comprehensive log of all sign-in activities, including successful and failed attempts, location, device information, and applied Conditional Access policies. This data is crucial for monitoring administrator activity, detecting suspicious behavior, and ensuring compliance with security policies.

An organization wants to protect against CEO fraud / business email compromise. Which Defender for Office 365 feature should be enabled?

Answer: Anti-phishing impersonation protection

Anti-phishing impersonation protection detects emails that attempt to impersonate specific users or domains, which is the mechanism behind BEC and CEO fraud.

What is the consequence of non-compliance for MS-500 - Microsoft 365 Security Administration professionals?

Answer: Potential fines, license revocation, legal liability, and reputational damage

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. Potential fines, license revocation, legal liability, and reputational damage represents the professional standard for regulatory in the MS-500 certification framework.

Which Apple enrollment mechanism, integrated with Apple Business Manager, allows IT to automatically enroll corporate-owned iOS/iPadOS devices into Intune before they reach end users?

Answer: Automated Device Enrollment (formerly DEP)

Automated Device Enrollment (ADE), formerly Device Enrollment Program (DEP), allows zero-touch enrollment of Apple devices directly through Apple Business Manager.

Which type of sensitive information type uses trainable classifiers rather than regex patterns to detect content?

Answer: Trainable classifiers

Trainable classifiers use machine learning models trained on sample content to identify categories of sensitive content that are difficult to define with regex patterns.

A label policy is configured to require users to justify downgrading a sensitivity label. What type of control is this?

Answer: Label justification for downgrade

Label justification for downgrade requires users to provide a reason when removing or lowering a sensitivity label, creating an audit trail for label changes.

How should MS-500 professionals apply research findings to practice?

Answer: Critically evaluate applicability, adapt to context, and monitor outcomes

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. Critically evaluate applicability, adapt to context, and monitor outcomes represents the professional standard for research in the MS-500 certification framework.

What is the value of written documentation in MS-500 professional communication?

Answer: It creates permanent records, ensures clarity, and provides legal protection

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. It creates permanent records, ensures clarity, and provides legal protection represents the professional standard for communication in the MS-500 certification framework.

What is the primary purpose of regulatory compliance in MS-500 - Microsoft 365 Security Administration practice?

Answer: To protect public safety, ensure quality standards, and maintain professional accountability

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. To protect public safety, ensure quality standards, and maintain professional accountability represents the professional standard for regulatory in the MS-500 certification framework.

What is the primary competency framework for MS-500 - Microsoft 365 Security Administration professionals?

Answer: Structured competency standards defined by the certifying body

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. Structured competency standards defined by the certifying body represents the professional standard for professional standards in the MS-500 certification framework.

What severity level should an organization assign when configuring Microsoft 365 Defender alert policies for high-impact events?

Answer: High

High-severity alerts should be assigned to events with significant business impact such as mass file deletion or ransomware activity.

What is reflective practice in MS-500 - Microsoft 365 Security Administration professional development?

Answer: Systematically examining experiences to gain insight and improve future practice

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. Systematically examining experiences to gain insight and improve future practice represents the professional standard for practical in the MS-500 certification framework.

Which Microsoft Purview feature is used to place a legal hold on a user's mailbox to preserve content for litigation?

Answer: eDiscovery hold (In-Place Hold)

eDiscovery holds in Microsoft Purview preserve mailbox content indefinitely or for a specified period to ensure it cannot be deleted during litigation.

What is a corrective action in MS-500 - Microsoft 365 Security Administration quality systems?

Answer: A systematic response to eliminate the cause of a detected nonconformity and prevent recurrence

This is fundamental to MS-500 - Microsoft 365 Security Administration practice. A systematic response to eliminate the cause of a detected nonconformity and prevent recurrence represents the professional standard for quality in the MS-500 certification framework.

Which role in Azure AD has the least privilege needed to manage Conditional Access policies?

Answer: Conditional Access Administrator

The Conditional Access Administrator role is specifically scoped to create and manage Conditional Access policies with minimal additional permissions.