Exam MS-500 topic 4 question 93 discussion

In the security defaults section of the provided article you can see that the provided answer is correct, the points awarded have just changed. The important thing to remember is that the security defaults: Ensure all users can complete MFA for secure access, Require MFA for administrative roles, and Enable policy to block legacy authentication. Adding all of the points for these options shown in Exam Topics, adds up to 27 points. Referring to the "How Improvement actions are scored" you will find that the given answer is also correct. Each improvement action is worth 10 points or less, and most are scored in a binary fashion. If you implement the improvement action, like create a new policy or turn on a specific setting, you get 100% of the points. For other improvement actions, points are given as a percentage of the total configuration. For example, an improvement action states you get 10 points by protecting all your users with multi-factor authentication. You only have 30 of 100 total users protected, so you'd get a partial score of 3 points (30 protected / 100 total * 10 max pts = 3pts).

answer 1: 27 points is correct. For answer 2 i think 0 points, because you are activating mfa for 30 users, but they are looking for "require mfa for administrative roles". how do you know, the 30 users have an administrative role?