MS-500 Endpoint Security & Device Management 3

Question 1

What is the key benefit of Intune App Protection Policies (APP) compared to device enrollment-based management?

Accepted Answer

They protect corporate data within apps on unmanaged (unenrolled) devices

Answer

App Protection Policies (MAM without enrollment) protect corporate data inside managed apps—such as Outlook and Teams—even when the device itself is not enrolled in Intune.

Question 2

Which Windows Autopilot deployment mode is designed for shared or kiosk devices with no user affinity that must configure themselves without any user interaction during setup?

Accepted Answer

Autopilot Self-Deploying Mode

Answer

Autopilot Self-Deploying Mode completes provisioning without user credentials or interaction, making it suitable for kiosks and shared devices.

Question 3

What query language does Microsoft Defender for Endpoint's Advanced Hunting feature use to search across endpoint telemetry and event data?

Accepted Answer

Kusto Query Language (KQL)

Answer

Advanced Hunting uses Kusto Query Language (KQL) to query large datasets of endpoint telemetry, enabling custom threat hunting and detection.

Question 4

When BitLocker is enabled and managed through Microsoft Intune on a Windows device, where are BitLocker recovery keys stored for administrator retrieval?

Accepted Answer

Escrowed to Azure Active Directory (Azure AD) and visible in Intune

Answer

Intune automatically escrows BitLocker recovery keys to Azure AD, allowing administrators to retrieve them from the Intune admin center or Azure AD device properties.

Question 5

Which Microsoft Defender for Endpoint plan includes Endpoint Detection and Response (EDR), Advanced Hunting with custom detections, and Threat and Vulnerability Management?

Accepted Answer

Microsoft Defender for Endpoint Plan 2 (P2)

Answer

Microsoft Defender for Endpoint Plan 2 (P2) includes the full feature set: EDR, Advanced Hunting, custom detections, Threat and Vulnerability Management, and behavioral analytics.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Endpoint Security & Device Management 3