MENU
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains a user named user1 and a Microsoft 365 group named Group1. All users are assigned a Defender for Endpoint Plan 1 license.
You enable Microsoft Defender XDR Unified role-based access control (RBAC) for Endpoints & Vulnerability Management.
You need to ensure that User1 can configure alerts that will send email notifications to Group1. The solution must follow the principle of least privilege.
Which permissions should you assign to User1?
Suggested Answer: A
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
34 comments · newest first
GE
Gerald
11 months ago
I’m surprised this is even a question, seems straightforward!
HO
Hoa
11 months ago
Wait, can User1 really do that with just one permission?
LA
Laila
11 months ago
I think B might be necessary too, though.
LA
Lavonne
12 months ago
Totally agree, A is the way to go!
IZ
Izetta
12 months ago
User1 needs Alerts investigation permission for that.
MA
Marylou
1 year ago
I think "Defender Vulnerability Management - Remediation handling" is more about fixing issues rather than configuring alerts, so I’m leaning towards option A.
ED
Eden
1 year ago
I feel like "Manage security settings" could also be relevant, but I’m not confident if it specifically allows for email notifications to groups.
AD
Adelle
1 year ago
This question seems similar to one we practiced about user roles in Defender. I think "Alerts investigation" might be the right choice since it relates to managing alerts.
DA
Daniela
1 year ago
I remember we discussed the principle of least privilege, but I'm not entirely sure which permission would be the best fit for configuring alerts.
NG
Ngoc
1 year ago
Okay, let me think this through. The key is that we need to follow the principle of least privilege, so we want to give User1 the minimum permissions needed to configure the alerts and send notifications to Group1. I'm leaning towards Alerts investigation as the best option.
BE
Bernardo
1 year ago
Hmm, I'm not sure about this one. The question mentions Defender for Endpoint and RBAC, so I'm wondering if there's some specific permission related to that which I should be looking for.
JU
Julio
1 year ago
This seems straightforward - I think the answer is Alerts investigation, since the question specifically asks about configuring alerts and email notifications.
GE
Geoffrey
1 year ago
I'm a bit confused by the different Defender for Endpoint options listed. Live response capabilities and Defender Vulnerability Management don't seem directly relevant to the task at hand. I think I'll go with Alerts investigation as well.
MA
Maurine
1 year ago
I'm a little confused by the options here. Appending the value manually or restarting the service don't seem like the right approaches. I think flushing the cache is the way to go, but I want to double-check that before submitting my answer.
TH
Theodora
1 year ago
I'm a little confused by this question. I'm not sure if the right answer is "Outcomes", "Value", "Utility", or "Warranty". I'll have to think it through a bit more before making a decision.
NI
Nichelle
2 years ago
Haha, can you imagine User1 getting Manage security settings? That's like handing the keys to the kingdom. A) is definitely the way to go.
VI
Vivan
2 years ago
I don't know, D) Live response capabilities: Basic sounds kind of cool. But I guess A) is the safer bet for this scenario.
AL
Alesia
2 years ago
I would go with A) as well. It seems like the most appropriate permission for User1 in this scenario.
MA
Marlon
2 years ago
D) Live response capabilities: Basic does sound cool, but A) is definitely the safer choice here.
GE
Gerald
2 years ago
Yeah, I agree. It follows the principle of least privilege.
KA
Kallie
2 years ago
I think A) Alerts investigation is the best option for configuring alerts.
CE
Cecily
2 years ago
C) Defender Vulnerability Management - Remediation handling seems like overkill for this task. A) is the obvious choice here.
GE
Gerald
2 years ago
Definitely, it aligns with the principle of least privilege.
MI
Mila
2 years ago
I agree, Alerts investigation is the most appropriate permission for configuring alerts.
NO
Novella
2 years ago
User1 should be assigned Alerts investigation.
AN
Annabelle
2 years ago
I agree, A) Alerts investigation is the way to go. Keeps things simple and follows the principle of least privilege.
ET
Ethan
2 years ago
The correct answer is A) Alerts investigation. This gives User1 the ability to configure alerts and send email notifications to Group1 without granting unnecessary permissions.
WI
Wilda
2 years ago
That makes sense, it follows the principle of least privilege.
TA
Tarra
2 years ago
That makes sense, it follows the principle of least privilege.
MA
Marylyn
2 years ago
User1 should be assigned Alerts investigation.
GE
Gearldine
2 years ago
User1 should be assigned Alerts investigation.
JE
Jesusita
2 years ago
I believe Alerts investigation would also be necessary for User1 to configure alerts effectively.
LY
Lynda
2 years ago
I agree with Luz. Manage security settings would allow User1 to configure alerts and send email notifications to Group1.
LU
Luz
2 years ago
I think User1 should be assigned Manage security settings.