MENU
You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1 and a user named User1.
You need to ensure that User1 can investigate incidents by using Workspace1. The solution must follow the principle of least privilege.
Which role should you assign to User1?
Suggested Answer: A
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
25 comments · newest first
DW
Dwight
4 months ago
True, but "Responder" lets them take action if needed. Balance is key!
NO
Norah
4 months ago
"Sentinel Reader" is least privilege. It allows viewing without editing.
OL
Oliva
4 months ago
Agreed, but isn't "Microsoft Sentinel Responder" better for investigations?
TH
Theola
5 months ago
I think User1 should get the "Microsoft Sentinel Reader" role.
CH
Chery
6 months ago
Nope, Reader is definitely the right choice for investigations!
LE
Leonora
6 months ago
I think "Microsoft Sentinel Responder" might be better for more access.
BL
Blossom
6 months ago
Wait, can they actually investigate with just that role?
RO
Rosalind
6 months ago
Totally agree, that's the least privilege approach!
LA
Lakeesha
6 months ago
You should assign the "Microsoft Sentinel Reader" role.
NI
Nieves
6 months ago
Wait, is there a "Security Sleuth" role? That's what I'd choose!
TY
Ty
7 months ago
I'm feeling the Security Incident Responder vibe. Sounds like a good fit.
DE
Delsie
7 months ago
Security Responder, easy peasy. Gotta be able to investigate those incidents!
CE
Cecilia
7 months ago
Hmm, I'd go with Security Reader. Gotta keep that privilege low, you know?
HA
Haydee
7 months ago
Security Analyst should do the trick.
FI
Fidelia
7 months ago
I feel like the "Security Reader" role could work, but I need to double-check if it covers all the investigation capabilities in Sentinel.
MI
Mickie
8 months ago
I practiced a similar question where the least privilege principle was key. I believe "Microsoft Sentinel Contributor" might be too much access for just investigating.
LA
Lakeesha
8 months ago
I'm not entirely sure, but I remember something about the "Security Reader" role being relevant for investigations.
KA
Kattie
8 months ago
I think User1 might need the "Microsoft Sentinel Reader" role since it allows viewing incidents without giving too many permissions.
SA
Salome
9 months ago
This seems straightforward. I'd just assign the Sentinel Responder role to User1 - that should let them look into incidents without too much extra permission. Seems like the right balance for this scenario.
GR
Gretchen
9 months ago
Okay, I've got a plan. I'll review the Sentinel documentation to see which role would let User1 investigate incidents without giving them unnecessary admin access. Gotta be careful with that least privilege thing.
AN
Annmarie
9 months ago
Hmm, not sure about this one. Gotta make sure we follow the principle of least privilege, but I'm not totally clear on what all the Sentinel roles can do. Might need to do some research to find the right one.
LA
Laurena
9 months ago
I think I'd start by looking at the different Sentinel roles and their permissions. Seems like we need to give User1 the right level of access to investigate incidents without too much extra power.
GI
Gilma
3 months ago
That sounds right, but what about "Sentinel Responder"?
XU
Xuan
3 months ago
Maybe the "Sentinel Reader" role?
FR
Frederica
3 months ago
I agree, checking the roles is essential.