Exam MS-500 All Questions

View all questions & answers for the MS-500 exam

Exam MS-500 topic 3 question 21 discussion

Actual exam question from Microsoft's MS-500

Question #: 21
Topic #: 3

HOTSPOT -
You have a Microsoft 365 subscription that contains a Microsoft SharePoint Online site named Site1. Site1 contains the folders shown in the following table.

At 09:00, you create a Microsoft Cloud App Security policy named Policy1 as shown in the following exhibit.

After you create Policy1, you upload files to Site1 as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

Reference:
https://docs.microsoft.com/en-us/cloud-app-security/data-protection-policies

by b00 at March 12, 2021, 4:28 p.m.

Comments

Submit Cancel

Sugar123

Highly Voted 4 years, 2 months ago

The conditions of the policy is that an alert will be created for any of the files in Folder 1 of Microsoft Sharepoint. However, the alert limit is set at 5. After the 5th alert, there will be no more alerts. From this rationale, File 1 triggers an alert since it is already in the Sharepoint Folder 1. File 3 does not trigger an alert because it is in Folder 2 (not applicable to the policy). File 9 does not trigger an alert because it would be the 6th alert and the alert threshold is 5.

upvoted 76 times

kiketxu

4 years, 2 months ago

Bit confused as the statment does not clarifies it's a file policy. Perfectly explained @Sugar123, thanks.

upvoted 3 times

b00

4 years, 2 months ago

Thanks Sugar123 !

upvoted 1 times

...

EzeQ

3 years, 9 months ago

It's only me, or is "File 9" the 5th file being uploaded to "Folder 1"? (and 2 files for "Folder 2") meaning that it will be triggered an alert.

upvoted 3 times

joergsi

3 years, 3 months ago

Made the same mistake by not putting the first table on the counter! There are already Files/Folder existing on the SharePoint than the ruleset is been created, and after this additional files are placed into the folder! Everything has to start with File1 not File3.

upvoted 1 times

...

b00

Highly Voted 4 years, 2 months ago

I do not understand the logic here.

upvoted 8 times

...

ChachaChatra

Most Recent 2 years, 4 months ago

Valid on28/01/23

upvoted 3 times

...

pete26

2 years, 7 months ago

Valid on exam October 14, 2022

upvoted 1 times

...

Bob27745

2 years, 8 months ago

Valid on Exam 9/21/2022

upvoted 1 times

...

LillyLiver

3 years, 1 month ago

I tell ya, I was all set to argue on this one. I thought the policy would not scan files already created. Which is why, I suspect, the question has the time at which the policy as created. To throw me (at least) off. But it will scan everything at the location. So I agree with the given answers. Y/N/N

upvoted 3 times

...

mkoprivnj

3 years, 6 months ago

Y, N, N File 1 triggers an alert since it is already in the Sharepoint Folder 1. File 3 does not trigger an alert because it is in Folder 2 (not applicable to the policy). File 9 does not trigger an alert because it would be the 6th alert and the alert threshold is 5.

upvoted 1 times

...

Catlander

3 years, 6 months ago

These questions are so tricky... But the limit of 5 is the reason file9 does not trigger an alarm

upvoted 1 times

Jhill777

3 years, 3 months ago

Tricky...aka dumb

upvoted 1 times

...

der_ausfahrt

3 years, 6 months ago

I'm interpreting this scenario as follows: File 1 triggers the alert since it was in Folder 1 already File 3 does not trigger the alert since it is in Folder 2 and policy is not applied to Folder 2 File 9 does not trigger alert because the limit was 5 times already...see explanation below File 1 was already in Folder 1 prior to or at 09:00 (doesn't specify) File 4 was the 2nd file in Folder 1 at 09:10 File 6 was the 3rd file in Folder 1 at 09:20 File 7 was the 4th file in Folder 1 at 09:25 File 8 was the 5th file in Folder 1 at 09:30 --> Daily alert limit of 5 was met File 9 was the 6th file in Folder 1 at 09:33

upvoted 7 times

...

Brandon_2319

3 years, 6 months ago

Can someone explain or show documentation why File 1 would trigger an alert if it was uploaded prior to the Policy being created...Will be testing this but In my opinion the answers would be No,No,Yes

upvoted 1 times

Bulldozzer

2 years, 10 months ago

You're right. "After you set an activity detection policy, it starts to generate alerts - alerts are only generated on activities that occur after you create the policy." Source - https://docs.microsoft.com/en-us/defender-cloud-apps/user-activity-policies

upvoted 1 times

...

Brandon_2319

3 years, 6 months ago

Nevermind.... from the documentation (https://docs.microsoft.com/en-us/cloud-app-security/data-protection-policies) "These policies detect and remediate any violations for at-rest information or when new content is created. Policies can be monitored using real-time alerts or using console-generated reports." So the answer would be correct : Yes,No,No

upvoted 3 times

...

kazaki

4 years, 2 months ago

1 & 9 shall create alerts

upvoted 2 times

...

Sido1

4 years, 2 months ago

confusing

upvoted 5 times

...