MENU
You have an Azure AD tenant and a Microsoft 365 E5 subscription. The tenant contains the users shown in the following table.
You plan to implement Microsoft Defender for Endpoint.
You verify that role-based access control (RBAC) is turned on in Microsoft Defender for Endpoint.
You need to identify which user can view security incidents from the Microsoft 365 Defender portal.
Which user should you identify?
Suggested Answer: A
Get Premium MS-102 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
12 comments · newest first
LA
Lavonne
11 months ago
I thought only admins could view security incidents, this is confusing!
MO
Mollie
11 months ago
Wait, are you sure User4 can't access it?
DE
Desmond
11 months ago
Definitely User1, they have the right role.
NG
Nguyet
11 months ago
I think User2 might be able to see them too.
DE
Deja
12 months ago
User3 has the right permissions for that.
LY
Lyndia
12 months ago
I’m leaning towards User4, but I’m a bit confused about how RBAC impacts their access in this scenario.
TH
Thurman
1 year ago
I feel like User1 could be a candidate too, but I need to double-check what roles they have assigned.
SE
Selma
1 year ago
I remember a practice question where User2 had similar permissions, but I can't recall if they had access to security incidents specifically.
YO
Yoko
1 year ago
I think User3 might be the right choice since they have the Security Administrator role, but I'm not entirely sure.
HO
Honey
1 year ago
Okay, I think I've got this. The key is that a single component can't be exposed as all those different service types at the same time. I'll need to pick the right one for this use case.
FR
Francisca
1 year ago
This seems familiar, was there a similar question about modes in one of our practice exams?
AR
Ardella
1 year ago
I'm feeling pretty confident about this. Deduplication is a common data backup technique, and the explanation makes it clear that the index for the duplicate block is deleted. I'll select True.