MS-500 Case Studies & Practical Application 5

Question 1

A financial services firm discovers that Microsoft Copilot for Microsoft 365 is surfacing confidential merger documents to employees who should not have access. What is the ROOT CAUSE and correct remediation?

Accepted Answer

Overpermissioned SharePoint sites allowing broad access; remediate with SharePoint Advanced Management and sensitivity labels

Answer

Copilot respects existing Microsoft 365 permissions, so surfaced content reflects underlying overpermissioning; the fix is to restrict site permissions and apply sensitivity labels using SharePoint Advanced Management.

Question 2

A company wants to automatically revoke access to all Microsoft 365 services within 5 minutes of an employee termination being processed in their HR system. Which integration achieves near-real-time deprovisioning?

Accepted Answer

Microsoft Entra ID Lifecycle Workflows triggered by HR system via provisioning connector

Answer

Entra ID Lifecycle Workflows can trigger automated tasks (disable account, revoke sessions, remove group memberships) within minutes of a lifecycle event sourced from an HR connector.

Question 3

Security Operations at Tailspin Toys wants to use a SOAR playbook to automatically block a compromised user's sign-in and notify the manager when a high-severity Defender XDR incident is created. Which service hosts these playbooks?

Accepted Answer

Microsoft Sentinel Logic App playbooks triggered by Sentinel analytics rules

Answer

Microsoft Sentinel Logic App playbooks can be triggered automatically by Sentinel analytics rules connected to Defender XDR incidents, enabling SOAR actions like blocking users and sending notifications.

Question 4

An admin applies a 'Highly Confidential' sensitivity label to a Teams meeting. What is the primary effect of this label on the meeting?

Accepted Answer

The meeting is blocked from being recorded or transcribed, and only internal users can join

Answer

Sensitivity labels applied to Teams meetings can restrict recording and transcription and limit attendees to internal users only, based on the label's configured meeting protection settings.

Question 5

Contoso's compliance team must demonstrate that their Microsoft 365 environment meets ISO 27001 controls. Which Microsoft tool provides pre-built assessments mapped to ISO 27001 with actionable improvement tasks?

Accepted Answer

Microsoft Compliance Manager with ISO 27001 assessment template

Answer

Microsoft Purview Compliance Manager includes pre-built assessment templates for ISO 27001 that map Microsoft actions and customer actions to specific controls, tracking compliance posture with a score.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Case Studies & Practical Application 5