MS-500 Risk Assessment & Management 2

Question 1

In Microsoft Secure Score, what does a 'Regression' status on a recommended action indicate?

Accepted Answer

The score for that action decreased since last measurement

Answer

A Regression status means the improvement action's score contribution has decreased, signaling a security control degraded since it was last evaluated.

Question 2

Which Microsoft 365 Defender feature provides an aggregated risk score based on device, identity, and app signals for a specific user?

Accepted Answer

Investigation priority score

Answer

Microsoft Defender for Office 365 and Defender XDR assign an Investigation priority score to users by combining behavioral anomalies, alert severity, and asset sensitivity.

Question 3

A company wants to assess risk from OAuth apps connected to Microsoft 365. Which tool surfaces app risk scores and permission scopes?

Accepted Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Cloud Apps (MDCA) provides an app risk score for each OAuth app based on permissions, community use, and publisher verification.

Question 4

Under the NIST Cybersecurity Framework, which function maps most directly to Microsoft Compliance Manager's assessment capabilities?

Accepted Answer

Identify

Answer

The NIST 'Identify' function covers asset management, risk assessment, and governance — which aligns with Compliance Manager's control assessments and risk scores.

Question 5

An admin notices a sign-in from an unfamiliar location immediately after a user's normal sign-in. Which Entra ID Protection risk detection type flags this pattern?

Accepted Answer

Atypical travel

Answer

Atypical travel detects sign-ins from locations that are unusual for the user based on their historical behavior, even if travel speed is plausible.

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 - Microsoft 365 Security Administration Practice Test

MS-500 Risk Assessment & Management 2