MS-500 Case Studies & Practical Application 3

Question 1

A company's CISO wants to enforce that only compliant, Intune-managed devices can access Exchange Online, regardless of user credentials. Which two components must be configured together?

Accepted Answer

Intune device compliance policy AND Conditional Access policy requiring compliant device

Answer

An Intune compliance policy defines what 'compliant' means, and a Conditional Access policy with the 'Require compliant device' grant control enforces that requirement at sign-in.

Question 2

An organization uses Microsoft 365 E5 and wants to detect when a user exports a large volume of records from SharePoint shortly before their termination date (loaded from HR). Which Insider Risk Management trigger should be configured?

Accepted Answer

Departing employee data theft template with HR connector trigger

Answer

The departing employee data theft template uses an HR connector to import resignation dates and automatically elevates risk scoring when activity spikes near the termination date.

Question 3

Contoso detects that an attacker used a compromised service principal to exfiltrate data from SharePoint via Microsoft Graph API. Which Microsoft 365 Defender capability surfaces this type of OAuth app abuse?

Accepted Answer

Defender for Cloud Apps OAuth app governance policies

Answer

Defender for Cloud Apps OAuth app governance provides visibility into app permissions and can alert on abnormal data access patterns by service principals and OAuth apps.

Question 4

A global company must comply with GDPR and ensure EU employees' data is processed only in EU data centers. Which Microsoft 365 feature helps demonstrate this compliance?

Accepted Answer

Microsoft Purview Data Residency commitments and Advanced Data Residency add-on

Answer

The Advanced Data Residency add-on provides contractual commitments and tooling to ensure specific Microsoft 365 workload data is stored and processed in the committed EU geo.

Question 5

A phishing simulation campaign reveals that 30% of employees clicked a malicious link. The security team wants to automate targeted training for those users. Which Microsoft 365 feature achieves this?

Accepted Answer

Microsoft Defender for Office 365 Attack Simulator with assigned training

Answer

Attack Simulation Training in Defender for Office 365 can automatically assign remediation training to users who fail simulations, targeting those who clicked the link.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Case Studies & Practical Application 3