MS-500 Professional Standards & Competencies 2

Question 1

An administrator must document all changes made to security policies in Microsoft 365 as part of a change management process. Which tool provides a unified audit log of administrative actions?

Accepted Answer

Microsoft Purview Audit

Answer

Microsoft Purview Audit (formerly Unified Audit Log) records administrative and user activity across Microsoft 365 services for compliance and investigation purposes.

Question 2

Under the Zero Trust model, which principle dictates that security should be applied regardless of whether a request originates inside or outside the corporate network?

Accepted Answer

Assume breach

Answer

The 'Assume breach' principle of Zero Trust mandates designing security controls as if the network is already compromised, removing implicit trust based on network location.

Question 3

A security administrator is required to attest quarterly that all privileged roles in Azure AD are still necessary. Which feature enforces this requirement?

Accepted Answer

Access Reviews in Azure AD Identity Governance

Answer

Azure AD Identity Governance Access Reviews allow administrators or resource owners to periodically certify that privileged role assignments remain appropriate.

Question 4

Which NIST Cybersecurity Framework function is being applied when a security team classifies data, inventories assets, and maps data flows in Microsoft 365?

Accepted Answer

Identify

Answer

The NIST CSF 'Identify' function covers asset management, business environment analysis, governance, risk assessment, and risk management strategy.

Question 5

A company's security policy requires that all service accounts in Microsoft 365 follow a naming convention and are documented in a central registry. What professional standard does this practice align with?

Accepted Answer

CIS Control 4 — Controlled Use of Administrative Privileges

Answer

CIS Control 4 focuses on the controlled use of administrative privileges, including inventorying and managing all admin/service accounts.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Professional Standards & Competencies 2