MENU
Your company uses Azure Sentinel.
A new security analyst reports that she cannot assign and dismiss incidents in Azure Sentinel. You need to resolve the issue for the analyst. The solution must use the principle of least privilege. Which role should you assign to the analyst?
Suggested Answer: A
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
11 comments · newest first
PO
Polly
12 months ago
I’m surprised there’s no specific role for just assigning incidents.
DE
Dean
1 year ago
Agreed, Responder is the way to go for least privilege!
CH
Chuck
1 year ago
Wait, can she really not assign incidents with just Reader access?
TE
Terrilyn
1 year ago
I think Azure Sentinel Contributor would be too much access.
TE
Tequila
1 year ago
Definitely need to assign the Azure Sentinel Responder role.
DI
Diego
1 year ago
I feel like the Reader role is definitely not the right one, but I can't recall if the Responder is the only one that fits here.
CA
Caren
1 year ago
I practiced a similar question, and I think the Responder role is specifically designed for handling incidents.
ST
Stanford
1 year ago
I remember that the Azure Sentinel Responder role allows users to manage incidents, so I think that might be the right choice.
RI
Rikki
1 year ago
I'm not entirely sure, but I think the Contributor role might give too much access. We need to stick to least privilege.
AI
Aimee
1 year ago
This question seems straightforward - I'm pretty confident I know the answer based on what I've learned about workplace privacy laws.
LA
Lauran
1 year ago
Hmm, I'm a bit unsure about this one. The JSON structure is not something I'm super familiar with, so I'll need to think it through carefully. Maybe I can eliminate a couple options and then make an educated guess.