MS-500 Communication & Stakeholder Relations 5

Question 1

A business unit leader objects to Microsoft Purview DLP policies blocking the emailing of certain file types, claiming it disrupts their workflow. What is the correct security team response process?

Accepted Answer

Review the business need, assess the risk, propose a least-privilege exception or alternative workflow, and obtain formal approval before any policy change

Answer

DLP exception requests require risk assessment and formal approval through a structured exception management process to maintain governance while accommodating legitimate business needs.

Question 2

A Microsoft 365 administrator is asked to explain Attack Simulation Training results to HR leadership who want to use results in performance reviews. What is the most appropriate guidance?

Accepted Answer

Advise HR that results should inform training needs, not performance reviews, as simulation is a learning tool and punitive use undermines program effectiveness

Answer

Using phishing simulation results punitively in performance reviews undermines the psychological safety needed for effective security awareness training and should be redirected toward learning outcomes.

Question 3

A Microsoft 365 security team must coordinate with external auditors reviewing the organization's ISO 27001 certification. Which Microsoft 365 tool provides the most comprehensive compliance documentation?

Accepted Answer

Microsoft Purview Compliance Manager with assessments and evidence documentation

Answer

Compliance Manager provides structured assessments mapped to regulatory frameworks with evidence collection, action item tracking, and compliance score — ideal for external auditors.

Question 4

During a security tabletop exercise, a participant asks who is responsible for approving emergency Conditional Access policy changes during an active attack. What should the security policy define?

Accepted Answer

A pre-designated break-glass authorization chain with at least two approvers from security leadership

Answer

Incident response procedures should define a pre-authorized emergency change path with multi-approver accountability to enable rapid response without bypassing governance.

Question 5

A vendor partner requests that their service account be excluded from MFA Conditional Access policies for integration purposes. What governance step is required before granting this exception?

Accepted Answer

Obtain written business justification, document the risk acceptance, use a service account with least-privilege permissions, and obtain CISO or equivalent approval

Answer

Service account MFA exclusions create risk and require formal risk acceptance documentation, least-privilege scoping, and leadership approval to maintain security governance.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Communication & Stakeholder Relations 5