MS-500 Technology & Digital Applications 3

Question 1

Which Microsoft 365 Defender feature correlates alerts from endpoints, email, identity, and cloud apps into a single incident?

Accepted Answer

Microsoft 365 Defender incident correlation

Answer

Microsoft 365 Defender automatically correlates related alerts across workloads into unified incidents for faster investigation.

Question 2

What is the effect of setting a retention policy with 'Preserve and then delete' action in Microsoft Purview?

Accepted Answer

Content is preserved for the retention period, then permanently deleted afterward

Answer

A 'Preserve and then delete' retention policy keeps content for the specified period and then permanently removes it.

Question 3

Which capability in Microsoft Defender for Identity detects lateral movement techniques such as Pass-the-Hash?

Accepted Answer

Lateral movement path detection

Answer

Defender for Identity's lateral movement path detection identifies attack paths that use credential theft techniques like Pass-the-Hash.

Question 4

An admin wants to allow only compliant devices to access Exchange Online. Which two technologies must be configured together?

Accepted Answer

Conditional Access policy + Intune device compliance policy

Answer

Conditional Access evaluates the device compliance signal provided by Intune to grant or block access to Exchange Online.

Question 5

What is the purpose of the 'Tenant Allow/Block List' in Microsoft Defender for Office 365?

Accepted Answer

To manually allow or block specific senders, URLs, or file hashes in email filtering

Answer

The Tenant Allow/Block List lets admins override filtering verdicts for specific email senders, URLs, or attachments.

MS-500 - Microsoft 365 Security Administration Practice Test