You need to give a manager, jdoe@Contoso.onmicrosoft.com, the ability to read events in security center, but prevent them from making any changes. Which command should you use?

Answer options:

A.Add-MsolRoleMember -RoleName "Security Administrator" -RoleMemberEmailAddress jdoe@Contoso.onmicrosoft.com
B.Add-MsolRoleMember -RoleName "Security Reader" -RoleMemberEmailAddress jdoe@Contoso.onmicrosoft.com
C.Add-MsolRoleMember -RoleName "Global Administrator" -RoleMemberEmailAddress jdoe@Contoso.onmicrosoft.com
D.Add-MsolRoleMember -RoleName "Global Reader" -RoleMemberEmailAddress jdoe@Contoso.onmicrosoft.com

Correct Answer: B Option B is correct. Read only access is granted to users with a Security Reader role in Azure AD. Always follow principle of least privilege.
Option A is incorrect. A security administrator can read security information and reports, and manage configuration.
Option C is incorrect. A global admin can manage all aspects of Azure and Microsoft services that use Azure identities.
Option D is incorrect. A global reader can read everything that a Global Administrator can.
Reference: 

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/rbac?view=o365-worldwide