Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft 365 Certified: Endpoint Administrator Associate · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
CopilotBased on the roles shown in the table and how Microsoft 365 Defender RBAC works: Key capability needed The question asks which user can view security incidents in the Microsoft 365 Defender portal. Role capabilities According to Microsoft’s RBAC definitions: Security Administrator → Full access, including managing and viewing incidents Security Operator → Can investigate incidents and alerts Security Reader → Can view everything, including incidents, alerts, secure score, and recommendations Compliance Administrator → Focused on compliance center; not relevant for Defender incidents The question is specifically about viewing incidents, not managing or resolving them. ➡️ Security Reader is explicitly allowed to view security incidents. **Correct user: ✔️ User3 – Security Reader**
Security Reader is the least privilege that can view incidents
C is corret. The Security Reader role provides global read‑only access to security‑related features, including viewing incidents, alerts, and reports in the Microsoft 365 Defender portal. Security Administrator and Security Operator can also view incidents but are intended for managing and responding to alerts; the question asks specifically who can view incidents, and among the listed roles Security Reader is the least‑privileged role that satisfies this requirement.