Question 200 A former vendor employee still appears on a sensitive site's allowed-users list despite removal from its project group. What should the admin investigate? Only the guest's preferred language setting Direct site permissions and other surviving group grants Only the tenant's domain verification history Only the user's Exchange spam quarantine Explanation Correct Answer B:Removing one group membership may leave separate authorization routes. Incorrect Answers A:Profile localization does not determine site permissions. C:DNS history cannot identify SharePoint permissions. D:Quarantine state cannot revoke site access.
Question 201 A security auditor needs to view tenant configuration but must not change it. Which administrative role is the closest baseline? Global Reader where the requested data is exposed to that role Exchange Administrator solely for Entra settings User Administrator for all tenants Global Administrator with permanent privileges Explanation Correct Answer A:Global Reader supplies broad read-oriented tenant visibility without Global Administrator writes. Incorrect Answers B:Exchange administration does not cover broad identity configuration. C:User management is narrower and includes changes not requested. D:Full write access is unnecessary for a configuration inventory.
Question 202 A help desk lead must create and update ordinary user accounts but must not administer all security policies. Which role should be evaluated? Compliance Data Administrator Security Reader Global Administrator for the whole tenant User Administrator with appropriate scope Explanation Correct Answer D:The role covers common user account lifecycle tasks without global policy control. Incorrect Answers A:Data compliance role groups do not provide broad user lifecycle privileges. B:Read-only security access does not create user accounts. C:Global privilege grants far more than regular user management.
Question 203 An administrator needs to assign available Microsoft 365 product licenses but should not edit tenant-wide Conditional Access. Which role fits? Global Administrator permanently License Administrator Security Administrator Reports Reader Explanation Correct Answer B:This role is designed to manage license assignments separately from broader security settings. Incorrect Answers A:Tenant-wide access exceeds a license-only requirement. C:Security administration does not primarily target product license allocation. D:Viewing reports does not authorize license assignments.
Question 204 A junior operator needs to reset regular employee passwords but should not reset privileged administrator credentials. Which role should be considered? Global Administrator Privileged Role Administrator Helpdesk Administrator within its supported target-account limits Global Reader Explanation Correct Answer C:The role offers limited reset and support capabilities without access to every privileged identity. Incorrect Answers A:Global privilege is not justified for standard password support. B:This role handles role assignments rather than normal help desk resets. D:Read-only access does not perform password resets.
Question 205 The support team needs to manage supported authentication methods for nonprivileged users. Which role is relevant? Reports Reader Exchange Administrator Compliance Administrator Authentication Administrator subject to target restrictions Explanation Correct Answer D:The role can manage eligible authentication methods without general global control. Incorrect Answers A:Reports Reader can inspect certain reports but not reset methods. B:Exchange role controls messaging workloads, not Entra authentication methods. C:Compliance data settings are distinct from authentication recovery.
Question 206 An incident requires resetting authentication methods for a highly privileged administrator. Which role capability should be evaluated? Teams Administrator Basic Helpdesk Administrator for any privileged account Privileged Authentication Administrator with strict approval Exchange Recipient Administrator Explanation Correct Answer C:This specialized role supports authentication management for privileged accounts. Incorrect Answers A:Teams settings cannot reset directory privileged authentication methods. B:Helpdesk scope does not universally cover high-privilege authentication methods. D:Recipient administration does not manage privileged authentication methods.
Question 207 An analyst needs to review Microsoft Defender findings without changing tenant security configuration. Which role may meet the need? License Administrator Global Administrator to view incidents Security Administrator with broad write permission by default Security Reader or an appropriately scoped Defender read-only role Explanation Correct Answer D:Read access separates investigation from policy changes. Incorrect Answers A:Licensing roles do not grant all needed security incident access. B:Full tenant administration is excessive for incident reading. C:Write privileges exceed a review-only task.
Question 208 A security lead must manage security settings and alerts across supported Microsoft services. What role should be evaluated? Billing Administrator Security Administrator with least-privilege scope Exchange Help Desk role only Reports Reader Explanation Correct Answer B:Security Administrator covers appropriate security configuration tasks. Incorrect Answers A:Billing roles do not configure Defender protections. C:An Exchange-scoped role is insufficient for broad Microsoft 365 security management. D:Read-only reporting cannot implement security changes.
Question 209 A compliance officer must maintain organization-wide retention and information protection settings. What role scope fits? Password Administrator A supported Microsoft Purview compliance administration role or role group Teams Communications Support Specialist Exchange Recipient Administrator only Explanation Correct Answer B:Purview RBAC controls policy administration separately from global tenant roles. Incorrect Answers A:Password reset rights cannot configure data governance. C:Call troubleshooting is unrelated to Purview retention configuration. D:Recipient administration does not create tenant-wide compliance policies.
Question 210 An operator must manage Exchange Online mailboxes and mail flow without editing Entra Conditional Access. Which role is appropriate? Security Reader Exchange Administrator with relevant workload permissions Global Administrator as the default permanent assignment Cloud Application Administrator Explanation Correct Answer B:This role scopes administrative authority to Exchange management tasks. Incorrect Answers A:A read-only security role cannot configure Exchange recipients. C:Global privilege includes unrelated identity and security controls. D:App registration permissions do not implement Exchange mail flow policies.
