Online Access Free MS-500 Exam Questions

You have a Microsoft 365 E5 subscription.
You plan to implement Microsoft Sentinel to create incidents based on:
* Azure Active Directory (Azure AD) Identity Protection alerts
* Correlated events from the DeviceProcessEvents table
Which analytic rule types should you use for each incident type? To answer, drag the appropriate rule types to the correct incident types. Each rule type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

Correct Answer:

Explanation

You have an Azure Sentinel workspace that has an Office 365 connector.
You are threat hunting events that have suspicious traffic from specific IP addresses.
You need to save the events and the relevant query results for future reference.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Correct Answer:

Explanation
Graphical user interface, text, application Description automatically generated

Reference:
https://docs.microsoft.com/en-us/azure/sentinel/bookmarks

You have a Microsoft 365 E5 subscription that contains 500 Windows 10 devices The subscription uses Microsoft Defender for Endpoint and is integrated with Microsoft Endpoint Manager. AJI the devices have Defender for Endpoint deployed.
You create a Conditional Access policy as shown in the following table.

You need to ensure that devices that have a machine risk s
core of high are blocked. What should you do in Microsoft Endpoint Manager?

• A.Apply a security baseline to all the devices.
• B.Apply an endpoint detection and response policy to the subscription.
• C.Apply a compliance policy to all the devices.
• D.Configure the Compliance policy settings.

You have a Microsoft 365 E5 subscription that has Microsoft 365 Defender enabled.
You plan to deploy a third-party app named App1 that will receive alert data from Microsoft 365 Defender.
Which format will Microsoft 365 Defender use to send the alert data to App1?

• A.ZIP
• B.XML
• C.JSON
• D.CSV

Your company plans to merge with another company.
A user named Debra Berger is an executive at your company.
You need to provide Debra Berger with all the email content of a user named Alex Wilber that contains the word merger.
To complete this task, sign in to the Microsoft 365 portal.