Microsoft Certified: Security Operations Analyst Associate Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  Correct Answer is User 1 for both: Microsoft 365 Defender Roles (high-level portal roles) These roles control permissions across the entire Microsoft 365 Defender portal, not just MDE: • Global Administrator Full access across M365 and Defender. • Security Administrator Manage security settings, incidents, alerts. • Security Operator Investigate alerts, perform response actions. • Security Reader Read-only access.

• 1

  The correct answer is User 1, User 3. The Security Admin role cannot apply security recommendations for a resource which enabling server vuln scanners would be. https://learn.microsoft.com/en-us/azure/defender-for-cloud/permissions

• 1

  User3 → Enable Microsoft Defender for Servers on virtual machines User1 → Review security recommendations and enable server vulnerability scans Tasks: 1. Enable Microsoft Defender for Servers on virtual machines This involves activating the Defender for Servers plan, which requires enabling extensions, assigning plans, or automating configurations on VMs. Requires permission to modify resource/subscription-level settings. ✅ Minimum role required: Contributor 2. Review security recommendations and enable vulnerability scans This involves: Viewing alerts and recommendations Applying security recommendations Enabling vulnerability assessment ✅ Required role: Security administrator ⚠️ Security reader can view, but cannot apply or enable anything.