MS-500 Professional Standards & Competencies 5

Question 1

A Microsoft 365 Security Administrator is responsible for maintaining a security operations playbook. What should the playbook include to meet professional standards?

Accepted Answer

Step-by-step response procedures for common incident types, escalation paths, and tool references

Answer

A professional security playbook must include detailed procedural steps, decision trees for common incident types, escalation procedures, and references to the tools used in response.

Question 2

What is the professional significance of maintaining a Configuration Management Database (CMDB) for Microsoft 365 security configurations?

Accepted Answer

It provides a baseline for detecting unauthorized configuration changes and supports change management

Answer

A CMDB documents the baseline configuration state, enabling detection of unauthorized drift and providing the documentation needed for structured change management processes.

Question 3

An organization is preparing for an ISO 27001 audit. The auditor asks for evidence that Microsoft 365 security controls are monitored continuously. Which Microsoft tool best provides this evidence?

Accepted Answer

Microsoft Compliance Manager with continuous assessment

Answer

Microsoft Compliance Manager provides continuous compliance assessment with automated control testing evidence, directly supporting ISO 27001 audit requirements.

Question 4

A security team lead is mentoring a junior administrator on least privilege. The junior admin asks why Global Administrator should not be used for daily tasks. What is the best explanation?

Accepted Answer

Using Global Admin for routine tasks exposes the highest-privilege account to greater risk; scoped roles limit blast radius if compromised

Answer

Using the least-privileged role for each task limits the damage if an account is compromised — a scoped role can only impact its specific area, unlike Global Admin which controls the entire tenant.

Question 5

When a Microsoft 365 Security Administrator leaves the organization, which professional standard practice must be immediately followed regarding their privileged access?

Accepted Answer

Immediately remove all privileged role assignments and revoke active sessions

Answer

Immediate removal of all privileged role assignments and session revocation prevents unauthorized access by former employees, a core identity lifecycle management requirement.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Professional Standards & Competencies 5