MS-500 Case Studies & Practical Application 4

Question 1

A law firm needs to ensure that documents labeled 'Privileged – Attorney Client' can never be printed or screen-captured, even by recipients inside the organization. Which capability enforces this?

Accepted Answer

Sensitivity label with Rights Management protection restricting Print and Screen Copy permissions

Answer

Rights Management (Azure Information Protection) integrated with sensitivity labels can restrict specific usage rights such as Print and Copy (screen capture) at the encryption level.

Question 2

An administrator notices that Microsoft Secure Score dropped by 15 points overnight. After investigation, they find that the 'Require MFA for all users' Conditional Access policy was disabled. Which Microsoft 365 Defender feature would have alerted the team immediately?

Accepted Answer

Microsoft Defender XDR incident queue with configuration change alert

Answer

Microsoft Defender XDR can generate incidents and alerts for configuration changes detected as anomalous, including disabling critical Conditional Access policies.

Question 3

Northwind Traders must implement Zero Trust network access for a legacy on-premises application accessed by remote workers. The app does not support modern authentication. Which Microsoft solution addresses this?

Accepted Answer

Microsoft Entra application proxy with pre-authentication

Answer

Microsoft Entra Application Proxy publishes on-premises apps to the internet with Entra ID pre-authentication, enabling Zero Trust access without requiring the app to support modern auth natively.

Question 4

During a red team exercise, testers exfiltrated data by uploading files to a personal Google Drive account from a corporate browser session. Which Microsoft 365 control would prevent this going forward?

Accepted Answer

Microsoft Defender for Cloud Apps session policy blocking uploads to unsanctioned cloud storage

Answer

A Defender for Cloud Apps session policy with Conditional Access App Control can inspect and block real-time uploads to unsanctioned cloud storage apps like personal Google Drive.

Question 5

A company with 10,000 users wants to identify which users have NOT enrolled in MFA and are accessing cloud apps from outside the corporate network. Which toolset provides this visibility most efficiently?

Accepted Answer

Microsoft Entra ID Authentication Methods Activity report combined with Conditional Access sign-in logs

Answer

The Authentication Methods Activity report shows MFA enrollment status at scale, and Conditional Access sign-in logs can be filtered to identify successful non-MFA sign-ins from external networks.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Case Studies & Practical Application 4