Exam MS-500: Microsoft 365 Security Administration Practice Test
Exam MS-500 practice addresses Microsoft 365 security administration across identity, email, endpoints, and access to organizational resources. The available questions use scenarios involving Microsoft Entra sign-in controls, Microsoft Defender protections, Exchange Online mailbox settings, group access, and licensing. They emphasize choosing administrative controls that match a specific security or access requirement.
Exam overview
About the Exam MS-500: Microsoft 365 Security Administration Exam
Security administration scenarios require distinguishing controls that address related but different risks. For identity, this includes reviewing sign-in details, limiting credential reuse, managing security-information registration for self-service password reset, and applying conditions to authentication. Email and endpoint scenarios involve recognizing protections for malicious links, reporting suspected phishing, and restricting unauthorized applications from changing protected folders. Other questions ask you to locate mailbox-specific settings, prevent external users from gaining access through a Microsoft 365 group, and determine how license assignment affects service availability. Practicing these decisions can help sharpen your ability to map a stated business need to the relevant Microsoft 365 control, identify where that control is configured, and interpret the security or access information an administrator needs to act.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
A company wants to reduce the spread of ransomware by preventing users from changing protected folders through unauthorized applications on Windows endpoints. Which Microsoft Defender capability is designed for this?
Show answer
Correct answer: BControlled folder access helps protect specified folders by allowing only trusted applications to make changes to files in them. Attack surface reduction rules address other risky behaviors, while network and exploit protection focus on different attack paths.
A security team wants to limit how long a user can use a refresh token before being required to authenticate again, with enforcement based on sign-in risk and other conditions. Which Microsoft Entra control is the most appropriate?
Show answer
Correct answer: AConditional Access session controls include sign-in frequency, which can require users to authenticate again after a configured interval. The other options address password management or application access rather than session duration.
A company wants to reduce the chance that users open links identified as malicious in email and supported Microsoft 365 apps. Which Microsoft Defender for Office 365 capability is intended for this purpose?
Show answer
Correct answer: ASafe Links checks URLs at time of click and can block access to links identified as malicious. Safe Attachments focuses on files, attack simulation training supports user awareness, and Defender for Identity monitors identity-related signals in on-premises environments.
An organization wants employees to report suspected phishing messages using a built-in reporting experience in Outlook. Which Microsoft 365 feature can provide this reporting mechanism?
Show answer
Correct answer: AUser-reported settings can configure how messages reported by users are handled and can provide a reporting experience in supported Outlook clients. Message trace tracks mail flow, eDiscovery searches content, and access reviews govern access assignments.
A security administrator wants to review the security settings applied to an Exchange Online mailbox, such as whether external access features are enabled. Which administrative interface is most appropriate for managing mailbox-specific configuration?
Show answer
Correct answer: AThe Exchange admin center is the primary administrative interface for Exchange Online settings, including mailbox configuration. The other portals focus on compliance, identity, and device management respectively.
An administrator wants to reduce the risk that a user’s password can be used to access other organizational accounts after being exposed in a breach. Which identity practice most directly addresses this risk?
Show answer
Correct answer: AUsing a unique password prevents a password exposed on one service from being reused to access other accounts. Storage quotas, sharing settings, and retention policies do not mitigate password reuse.
An administrator wants to require users to register security information before they can use self-service password reset. Which Microsoft Entra feature supports this setup?
Show answer
Correct answer: AThe Authentication methods policy controls which authentication methods users can register and use. It can be configured alongside registration requirements for self-service password reset.
How to use this practice test
The free US Practice Tests practice session draws up to 20 random questions from the 50-question MS-500 bank. Questions use Microsoft 365 security scenarios, including identity controls, email protection, endpoint safeguards, and access administration. Results appear after the session so you can identify which types of control-selection decisions need further review.
Preparation tips
- Compare Microsoft Entra sign-in controls by the signal they use, such as sign-in risk, and the authentication behavior they enforce.
- Distinguish Microsoft Defender protections for malicious email links from tools that let users report suspected phishing.
- Review how endpoint controls can prevent unauthorized applications from changing protected folders.
- Practice tracing access issues through Microsoft 365 group membership settings, mailbox configuration, and assigned license service plans.
- When reviewing a suspicious sign-in, identify which sign-in details help establish where and how the account was accessed.