Microsoft Azure Security Engineer Associate AZ-500 Practice Question

The Security Reader role grants read-only access to security-related information such as Microsoft Defender for Cloud recommendations, secure score, and Azure AD Identity Protection data. It does not permit any configuration changes. The Reader role can view most Azure resources but lacks permissions for many Microsoft.Security actions, so it may not display all security findings. Security Admin includes write permissions to security settings, which is more access than required. Global Reader is an Azure AD role that provides directory-wide read-only access but does not extend to Defender for Cloud data at the subscription level.