MS-500 Exam Question 131
You create a label that encrypts email data. Users report that they cannot use the label in Outlook on the web to protect the email messages they send.
You need to ensure that the users can use the new label to protect their email.
What should you do?
You need to ensure that the users can use the new label to protect their email.
What should you do?
MS-500 Exam Question 132
You have a Microsoft Sentinel workspace that has an Azure Active Directory (Azure AD) connector and an Office 365 connector.
From the workspace, you plan to create an analytics rule that will be based on a custom query and will run a security play.
You need to ensure that you can add the security playbook and the custom query to the rule.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
From the workspace, you plan to create an analytics rule that will be based on a custom query and will run a security play.
You need to ensure that you can add the security playbook and the custom query to the rule.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
MS-500 Exam Question 133
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint and contains a Windows
10 device named Device1.
You have a PowerShell script named script1 that collects forensic data and saves the results as a file on the device from which the script is run.
You receive a Microsoft Defender for Endpoint alert for suspicious activities on Device1.
You need to run script1 on Device1 and retrieve the output file of the script.
Which four actions should you perform in sequence in Microsoft 365 Defender portal? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
10 device named Device1.
You have a PowerShell script named script1 that collects forensic data and saves the results as a file on the device from which the script is run.
You receive a Microsoft Defender for Endpoint alert for suspicious activities on Device1.
You need to run script1 on Device1 and retrieve the output file of the script.
Which four actions should you perform in sequence in Microsoft 365 Defender portal? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
MS-500 Exam Question 134
You have a Microsoft 365 E5 subscription and 5,000 users.
You create several alert policies that are triggered every time activities match rules.
You need to create an alert policy that is triggered when the volume of matched activities becomes unusual.
What should you do first?
You create several alert policies that are triggered every time activities match rules.
You need to create an alert policy that is triggered when the volume of matched activities becomes unusual.
What should you do first?
MS-500 Exam Question 135
You plan to publish a label that will retain documents in Microsoft OneDrive for two years, and then automatically delete the documents.
You need to create the label.
To complete this task, sign in to the Microsoft Office 365 portal.
You need to create the label.
To complete this task, sign in to the Microsoft Office 365 portal.