MS-500 Professional Standards & Competencies 4

Question 1

A security administrator is asked to implement controls aligned with the CIS Benchmarks for Microsoft 365. Where can these benchmarks be authoritatively obtained?

Accepted Answer

Center for Internet Security (CIS) official website

Answer

CIS Benchmarks are published and maintained by the Center for Internet Security and are available on the CIS official website at cisecurity.org.

Question 2

During an incident response exercise, the security team must contain a compromised user account. What is the correct sequence of initial containment steps in Microsoft 365?

Accepted Answer

Disable the account → revoke all active sessions → reset credentials → investigate

Answer

Best practice containment starts with disabling the account, then revoking active sessions to terminate access, followed by credential reset, and then investigation.

Question 3

An organization's security policy requires separation of duties for Exchange Online administration. Which configuration enforces this principle by requiring two administrators to approve sensitive actions?

Accepted Answer

Privileged Access Management (PAM) in Microsoft Purview with approval workflow

Answer

Microsoft Purview Privileged Access Management enforces just-in-time, just-enough-access for privileged Exchange tasks with a required approval workflow, implementing separation of duties.

Question 4

A security administrator must ensure that Microsoft 365 security controls are regularly tested and validated. Which practice best fulfills this professional competency?

Accepted Answer

Conducting periodic penetration tests and red team exercises

Answer

Penetration testing and red team exercises actively validate that security controls work as intended by simulating real attacker techniques, going beyond passive monitoring.

Question 5

A compliance officer asks the security team to demonstrate that Microsoft does not access customer data without authorization. Which feature allows customers to approve or reject Microsoft engineer access requests?

Accepted Answer

Customer Lockbox

Answer

Customer Lockbox requires Microsoft to obtain explicit customer approval before a Microsoft support engineer can access customer content during a support operation.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Professional Standards & Competencies 4