QUESTION: 5 Exam Topic: Implement and manage threat protection questions

SIMULATION
You need to configure your organization to automatically quarantine all phishing email messages.
To complete this task, sign in to the Microsoft 365 portal.

See Explanation section for answer.

Answer(s): A

Explanation:

You need to edit the Anti-Phishing policy.
1. Go to the Office 365 Security & Compliance admin center.
2. Navigate to Threat Management > Policy > ATP Anti-Phishing.
3. Click on Default Policy.
4. In the Impersonation section, click Edit.
5. Go to the Actions section.
6. In the If email is sent by an impersonated user: box, select Quarantine the message from the drop- down list.
7. In the If email is sent by an impersonated domain: box, select Quarantine the message from the drop- down list.
8. Click Save to save the changes.
9. Click Close to close the anti-phishing policy window.

Reveal Solution Next Question

QUESTION: 6 Exam Topic: Implement and manage threat protection questions

You configure several Advanced Threat Protection (ATP) policies in a Microsoft 365 subscription. You need to allow a user named User1 to view ATP reports in the Threat management dashboard. Which role provides User1 with the required role permissions?

Security administrators
Exchange administrator
Compliance administrator
Message center reader

Answer(s): A

Reference:

https://docs.microsoft.com/en-us/office365/securitycompliance/view-reports-for-atp#what-permissions-are-needed-to-view-the-atp-reports

Reveal Solution Next Question

QUESTION: 7 Exam Topic: Implement and manage threat protection questions

You have a Microsoft 365 subscription and a Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) subscription.
You have devices enrolled in Microsoft Endpoint Manager as shown in the following table:

You integrate Microsoft Defender ATP and Endpoint Manager.
You plan to evaluate the Microsoft Defender ATP risk level for the devices. You need to identify which devices can be evaluated.

Which devices should you identify?

Device1 and Device2 only
Device1 only
Device1 and Device3 only
Device1, Device2 and Device3

Answer(s): D

Explanation:

Microsoft Defender ATP (now known as Microsoft Defender for Endpoint) now supports Windows 7 SP1 and above, Windows Server 2008 SP1 and above, the three most recent major releases of macOS, iOS 11.0 and above, Android 6.0 and above and Red Hat Enterprise Linux 7.2 or higher, CentOS 7.2 or higher, Ubuntu 16.04 LTS or higher LTS, Debian 9 or higher, SUSE Linux Enterprise Server 12 or higher, and Oracle Linux 7.2 or higher.

Reference:

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements

Reveal Solution Next Question

QUESTION: 8 Exam Topic: Implement and manage threat protection questions

HOTSPOT (Drag and Drop is not supported)
You have a Microsoft 365 E5 subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com.

Azure AD Identity Protection alerts for contoso.com are configured as shown in the following exhibit.

A user named User1 is configured to receive alerts from Azure AD Identity Protection. You create users in contoso.com as shown in the following table.

The users perform the sign-ins shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: No
User1 will receive the two alerts classified as medium or higher.
Sign-ins from infected device is classified as low. This risk detection identifies IP addresses, not user devices. If several devices are behind a single IP address, and only some are controlled by a bot network, sign-ins from other devices my trigger this event unnecessarily, which is why this risk detection is classified as Low.

Box 2: No
User2 will receive the two alerts classified as medium or higher.
Email alerts are sent to all global admins, security admins and security readers
Sign-ins from infected device is classified as low. This risk detection identifies IP addresses, not user devices. If several devices are behind a single IP address, and only some are controlled by a bot network, sign-ins from other devices my trigger this event unnecessarily, which is why this risk detection is classified as Low.

Box 3: No
User3 will not receive alters.
Email alerts are sent to all global admins, security admins and security readers.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies

Reveal Solution Next Question

Free MS-500 Exam Braindumps (page: 30)

QUESTION: 5 Exam Topic: Implement and manage threat protection questions

Explanation:

QUESTION: 6 Exam Topic: Implement and manage threat protection questions

Reference:

QUESTION: 7 Exam Topic: Implement and manage threat protection questions

Explanation:

Reference:

QUESTION: 8 Exam Topic: Implement and manage threat protection questions

Explanation:

Reference: