MS-500 Research & Evidence-Based Practice 2

Question 1

Microsoft Secure Score is primarily designed to help organizations do what?

Accepted Answer

Measure and improve their security posture based on recommended actions

Answer

Microsoft Secure Score quantifies an organization's security posture and provides actionable improvement recommendations.

Question 2

Which Microsoft 365 Defender feature allows security analysts to write custom KQL queries to hunt for threats across historical data?

Accepted Answer

Advanced hunting

Answer

Advanced hunting uses Kusto Query Language (KQL) to query up to 30 days of raw security event data.

Question 3

In Microsoft Sentinel, what is the primary container that groups related alerts, entities, and evidence for a single investigation?

Accepted Answer

Incident

Answer

Incidents in Microsoft Sentinel aggregate correlated alerts and associated entities into a single investigation unit.

Question 4

A security team wants to understand the tactics and techniques used in an active threat campaign targeting their industry. Which Microsoft 365 Defender section provides this contextual intelligence?

Accepted Answer

Threat analytics

Answer

Threat analytics provides curated reports authored by Microsoft researchers on active threat campaigns, including MITRE ATT&CK mappings.

Question 5

Which Microsoft feature allows an admin to simulate phishing attacks against employees and provide targeted security awareness training to those who were deceived?

Accepted Answer

Attack simulation training

Answer

Attack simulation training in Microsoft Defender for Office 365 runs simulated phishing campaigns and automatically assigns remediation training.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Research & Evidence-Based Practice 2