MS-500 Case Studies & Practical Application 2

Question 1

Contoso's SOC team discovers that a compromised admin account was used to create a new Global Admin and disable audit logging. Which Microsoft 365 Defender feature would have alerted the team to this lateral movement in near real-time?

Accepted Answer

Defender for Cloud Apps activity policies

Answer

Defender for Cloud Apps activity policies can trigger real-time alerts on administrative actions such as creating privileged accounts or modifying audit settings.

Question 2

A healthcare organization must ensure that patient data (PHI) shared via Microsoft Teams is automatically classified and protected. Which solution combination achieves this without end-user intervention?

Accepted Answer

Sensitivity labels with auto-labeling policies and Rights Management encryption

Answer

Auto-labeling policies use trainable classifiers or sensitive information types to detect PHI and automatically apply sensitivity labels that enforce Rights Management encryption.

Question 3

An attacker performed a password spray attack and successfully authenticated as five users. Microsoft Entra ID Protection flagged the sign-ins as high-risk. What is the FASTEST remediation action an admin can take to block further access while preserving the accounts for investigation?

Accepted Answer

Enable a Conditional Access policy that blocks users with high user risk

Answer

A Conditional Access policy scoped to high user risk immediately blocks sign-ins for all flagged users without requiring manual per-account action, preserving accounts for investigation.

Question 4

Fabrikam's IT team wants to prevent users from forwarding email to external domains using Outlook rules, while still allowing legitimate external email. Which policy type addresses this specific threat?

Accepted Answer

Exchange Online mail flow rule blocking external auto-forward

Answer

An Exchange Online mail flow (transport) rule can specifically block auto-forwarding to external recipients while allowing normal outbound email to flow.

Question 5

During an insider threat investigation, a legal team needs all email and Teams messages from a specific employee preserved immediately, even if the employee deletes them. What is the correct first step?

Accepted Answer

Place the employee's mailbox on Litigation Hold

Answer

Litigation Hold immediately preserves all content in the mailbox—including deleted items—for as long as the hold is active, satisfying legal preservation requirements.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Case Studies & Practical Application 2