MS-500 Endpoint Security & Device Management 2

Question 1

Which Microsoft Defender for Endpoint feature continuously discovers software vulnerabilities and misconfigurations on enrolled devices and prioritizes them by risk?

Accepted Answer

Threat and Vulnerability Management (TVM)

Answer

Advanced Hunting

Answer

Attack Surface Reduction rules

Answer

Automated Investigation and Remediation

Question 2

Which Attack Surface Reduction (ASR) rule helps prevent Office applications, such as Word and Excel, from spawning potentially malicious child processes?

Accepted Answer

Block Office applications from creating child processes

Answer

Block executable content from email client and webmail

Answer

Block credential stealing from Windows LSASS

Answer

Block untrusted and unsigned processes that run from USB

Question 3

In Microsoft Intune, what is the purpose of a Configuration Profile?

Accepted Answer

Applying device settings such as Wi-Fi, VPN, restrictions, and security baselines

Answer

Managing user account passwords and MFA settings

Answer

Enrolling new devices into Intune management

Answer

Monitoring real-time device compliance status

Question 4

Which Microsoft Defender for Endpoint feature uses AI to automatically investigate security alerts and take or recommend remediation actions to reduce the analyst workload?

Accepted Answer

Automated Investigation and Remediation (AIR)

Answer

Threat and Vulnerability Management

Answer

Advanced Hunting with KQL

Answer

Attack Surface Reduction rules

Question 5

Which Android enrollment mode in Microsoft Intune creates a separate, encrypted work profile on a personally owned device to isolate corporate data from personal data?

Accepted Answer

Android Enterprise Work Profile (BYOD)

Answer

Android Enterprise Fully Managed

Answer

Android Enterprise Dedicated Device

Answer

Android Device Administrator (legacy)

Question 6

How does Microsoft Defender for Endpoint integrate with Microsoft Intune to enforce risk-based Conditional Access?

Accepted Answer

Through the Microsoft Defender for Endpoint connector in Intune, which feeds device risk scores into compliance policies

Answer

By sending alerts directly to Azure Sentinel

Answer

By writing compliance data to Azure Monitor Logs

Answer

By pushing configuration profiles to non-compliant devices

Question 7

Which Microsoft 365 security portal serves as the unified console for investigating endpoint alerts, running advanced hunts, and managing Microsoft Defender for Endpoint policies?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com)

Answer

Microsoft Endpoint Manager admin center (endpoint.microsoft.com)

Answer

Azure Security Center (portal.azure.com)

Answer

Microsoft 365 compliance center (compliance.microsoft.com)