MS-500 Professional Standards & Competencies 4 — Questions and Answers
Question 1: A security administrator is asked to implement controls aligned with the CIS Benchmarks for Microsoft 365. Where can these benchmarks be authoritatively obtained?
- Microsoft Trust Center
- Center for Internet Security (CIS) official website (Correct answer)
- NIST National Vulnerability Database
- Microsoft Purview Compliance Manager
Correct answer: Center for Internet Security (CIS) official website
CIS Benchmarks are published and maintained by the Center for Internet Security and are available on the CIS official website at cisecurity.org.
Question 2: During an incident response exercise, the security team must contain a compromised user account. What is the correct sequence of initial containment steps in Microsoft 365?
- Delete the account → revoke sessions → notify user
- Disable the account → revoke all active sessions → reset credentials → investigate (Correct answer)
- Reset password → enable MFA → review audit logs
- Block sign-in → remove all licenses → open support ticket
Correct answer: Disable the account → revoke all active sessions → reset credentials → investigate
Best practice containment starts with disabling the account, then revoking active sessions to terminate access, followed by credential reset, and then investigation.
Question 3: An organization's security policy requires separation of duties for Exchange Online administration. Which configuration enforces this principle by requiring two administrators to approve sensitive actions?
- Dual approval in Microsoft Purview Customer Lockbox
- Customer Lockbox is for Microsoft engineers, not internal admins — use Exchange Multi-Admin Approval (Four-Eyes Principle) via compliance policies
- Conditional Access requiring two admin accounts to sign in simultaneously
- Privileged Access Management (PAM) in Microsoft Purview with approval workflow (Correct answer)
Correct answer: Privileged Access Management (PAM) in Microsoft Purview with approval workflow
Microsoft Purview Privileged Access Management enforces just-in-time, just-enough-access for privileged Exchange tasks with a required approval workflow, implementing separation of duties.
Question 4: A security administrator must ensure that Microsoft 365 security controls are regularly tested and validated. Which practice best fulfills this professional competency?
- Running monthly Secure Score reports
- Conducting periodic penetration tests and red team exercises (Correct answer)
- Enabling all Microsoft Defender alerts
- Reviewing Azure AD sign-in logs weekly
Correct answer: Conducting periodic penetration tests and red team exercises
Penetration testing and red team exercises actively validate that security controls work as intended by simulating real attacker techniques, going beyond passive monitoring.
Question 5: A compliance officer asks the security team to demonstrate that Microsoft does not access customer data without authorization. Which feature allows customers to approve or reject Microsoft engineer access requests?
- Privileged Access Management
- Customer Lockbox (Correct answer)
- Microsoft Purview Audit Premium
- Microsoft Secure Score
Correct answer: Customer Lockbox
Customer Lockbox requires Microsoft to obtain explicit customer approval before a Microsoft support engineer can access customer content during a support operation.
Question 6: When defining security metrics for a Microsoft 365 environment, which metric directly measures the effectiveness of the incident detection capability?
- Mean Time to Recover (MTTR)
- Mean Time to Detect (MTTD) (Correct answer)
- Number of Secure Score points gained
- Total number of policies configured
Correct answer: Mean Time to Detect (MTTD)
Mean Time to Detect (MTTD) measures how long it takes from the start of a security incident to its detection, directly reflecting detection capability effectiveness.
Question 7: An administrator needs to ensure that Microsoft 365 security configurations are documented and repeatable across multiple tenants. What approach best supports this professional competency?
- Manually configure each tenant and take screenshots
- Use Microsoft 365 DSC (Desired State Configuration) to export and apply configuration as code (Correct answer)
- Export Secure Score reports quarterly
- Use PowerShell scripts stored in personal OneDrive
Correct answer: Use Microsoft 365 DSC (Desired State Configuration) to export and apply configuration as code
Microsoft 365 Desired State Configuration (M365DSC) treats tenant configuration as code, enabling version-controlled, repeatable, and auditable deployment of security settings.
MS-500 Professional Standards & Competencies 4
A security administrator is asked to implement controls aligned with the CIS Benchmarks for Microsoft 365.
Where can these benchmarks be authoritatively obtained?