Certification signals more than knowledge: candidates who earn the Microsoft 365 Security Administration credential show the dedication and execution that projects demand, and GuideTorrent helps you build toward the MS-500 exam one verified answer at a time.
Microsoft MS-500 Exam Overview:
| Certification Vendor: | Microsoft |
|---|---|
| Exam Name: | Microsoft 365 Security Administration |
| Exam Number: | MS-500 |
| Real Exam Qty: | 40-60 |
| Related Certifications: | Microsoft 365 Certified: Security Administrator Associate |
| Certificate Validity Period: | Certification retired June 30, 2023 |
| Passing Score: | 700 |
| Exam Format: | Drag and drop, Case studies, Multiple choice |
| Exam Price: | US$165 |
| Available Languages: | French, English, Spanish, Portuguese (Brazil), Japanese, Chinese (Simplified), German |
| Exam Duration: | 100 minutes |
| Sample Questions: |  |
| Exam Way: | Online or at authorized test center |
| Pre Condition: | Familiarity with Microsoft 365 workloads and experience with identity, threat, and information protection |
| Official Syllabus URL: | https://learn.microsoft.com/en-us/credentials/certifications/exams/ms-500 |
Microsoft MS-500 Exam Syllabus Topics:
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Implement and manage identity and access | 25-30% | - Plan and implement identity and access for Microsoft 365 hybrid environments
|
| Topic 2: Implement and manage threat protection | 30-35% | - Cloud and collaboration security
|
| Topic 3: Implement and manage information protection | 15-20% | - Manage sensitive information
|
| Topic 4: Manage compliance in Microsoft 365 | 20-25% | - Audit and compliance solutions
|
MS-500 Exam Facts and Self-Paced Study at GuideTorrent
- Implement and manage threat protection (30-35%)
- Implement and manage information protection (15-20%)
- Implement and manage identity and access (25-30%)
Microsoft 365 Security Administration Sample Questions:
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table.
You discover that several security alerts are visible from the Microsoft Defender for Identity portal.
You need to identify which users in contoso.com can close the security alerts.
Which users should you identify?
- A. User3 and User4 only
- B. User3 only
- C. User1 and User3 only
- D. User1 and User2 only
- E. User1 only
Correct Answer: B 🗳️
Explanation: Only visible for GuideTorrent members. You can sign-up / login (it's free).
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a Microsoft 365 E5 subscription that contains a user named User1.
The Azure Active Directory (Azure AD) Identity Protection risky users report identifies User1.
For User1, you select Confirm user compromised.
User1 can still sign in.
You need to prevent User1 from signing in. The solution must minimize the impact on users at a lower risk level.
Solution: You configure the sign-in risk policy to block access when the sign-in risk level is high.
Does this meet the goal?
- A. Yes
- B. No
Correct Answer: B 🗳️
Explanation: Only visible for GuideTorrent members. You can sign-up / login (it's free).
You have a Microsoft Defender for Endpoint deployment that has custom network indicators turned on.
Microsoft Defender for Endpoint protects two computers that run Windows 10 as shown in the following table.
Microsoft Defender foe Endpoint has the device groups shown in the following table.
Correct Answer:
Explanation
Please wait while the virtual machine loads. Once loaded, you may proceed to the lab section. This may take a few minutes, and the wait time will not be deducted from your overall test time.
When the Next button is available, click it to access the lab section. In this section, you will perform a set of tasks in a live environment. While most functionality will be available to you as it would be in a live environment, some functionality (e.g., copy and paste, ability to navigate to external websites) will not be possible by design.
Scoring is based on the outcome of performing the tasks stated in the lab. In other words, it doesn't matter how you accomplish the task, if you successfully perform it, you will earn credit for that task.
Labs are not timed separately, and this exam may more than one lab that you must complete. You can use as much time as you would like to complete each lab. But, you should manage your time appropriately to ensure that you are able to complete the lab(s) and all other sections of the exam in the time provided.
Please note that once you submit your work by clicking the Next button within a lab, you will NOT be able to return to the lab.
Username and password
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Microsoft 365 Username:
admin@[email protected]
Microsoft 365 Password: #HSP.ug?$p6un
If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support only:
Lab instance: 11122308
You need to protect against phishing attacks. The solution must meet the following requirements:
Phishing email messages must be quarantined if the messages are sent from a spoofed domain.
As many phishing email messages as possible must be identified.
The solution must apply to the current SMTP domain names and any domain names added later.
To complete this task, sign in to the Microsoft 365 admin center.
Correct Answer:
See explanation below.
Explanation
1. After signing in to the Microsoft 365 admin center, select Security, Threat Management, Policy, then ATP Anti-phishing.
2. Select Default Policy to refine it.
3. In the Impersonation section, select Edit.
4. Go to Add domains to protect and select the toggle to automatically include the domains you own.
5. Go to Actions, open the drop-down If email is sent by an impersonated user, and choose the Quarantine message action.
Open the drop-down If email is sent by an impersonated domain and choose the Quarantine message action.
6. Select Turn on impersonation safety tips. Choose whether tips should be provided to users when the system detects impersonated users, domains, or unusual characters. Select Save.
7. Select Mailbox intelligence and verify that it's turned on. This allows your email to be more efficient by learning usage patterns.
8. Choose Add trusted senders and domains. Here you can add email addresses or domains that shouldn't be classified as an impersonation.
9. Choose Review your settings, make sure everything is correct, select Save, then Close.
Reference:
https://support.office.com/en-us/article/protect-against-phishing-attempts-in-microsoft-365-86c425e1-1686-430a
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies?view=
You have a Microsoft 365 subscription that contains several Windows 10 devices. The devices are managed by using Microsoft Endpoint Manager.
You need to enable Microsoft Defender Exploit Guard (Microsoft Defender EG) on the devices.
Which type of device configuration profile should you use?
- A. Device restrictions
- B. identity protection
- C. Endpoint protection
- D. Microsoft Defender for Endpoint
Correct Answer: C 🗳️
Viewing page 1 out of 66 pages.
Viewing questions 1-5 out of 329 questions.
