MENU
You use Azure Sentinel.
You need to use a built-in role to provide a security analyst with the ability to edit the queries of custom Azure Sentinel workbooks. The solution must use the principle of least privilege.
Which role should you assign to the analyst?
Suggested Answer: A
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Azure Sentinel Contributor can create and edit workbooks, analytics rules, and other Azure Sentinel resources.
13 comments · newest first
TA
Taryn
12 months ago
Yeah, least privilege is key, so Contributor makes sense here.
DO
Dominga
1 year ago
Wait, are you sure it's not Logic App Contributor? That sounds relevant.
IL
Ilda
1 year ago
Azure Sentinel Responder? Seems too limited for editing workbooks.
LA
Larae
1 year ago
I thought Security Administrator would work too, but not for editing queries.
LA
Lashon
1 year ago
Definitely go with Azure Sentinel Contributor for this!
TI
Timmy
1 year ago
Logic App Contributor seems unrelated to workbooks, so I don’t think that’s the answer. I’m leaning towards Azure Sentinel Contributor as well.
ON
Ona
1 year ago
I’m a bit confused about the difference between the Azure Sentinel Contributor and the Responder roles. I feel like Contributor is the one we want, but I could be wrong.
XE
Xenia
1 year ago
I think the Azure Sentinel Contributor role might be the right choice since it sounds like it allows for editing workbooks, but I'm not entirely sure.
CA
Candra
1 year ago
I remember practicing a similar question, and I believe the Security Administrator role has broader permissions than what we need here.
KE
Keneth
1 year ago
Okay, let me think this through step-by-step. Total employees = 1,238. Terminations = 56. Turnover rate = 56 / 1,238 = 0.0452 or 4.52%. So the correct answer is C) 22%.
YU
Yun
1 year ago
I'm a bit confused on this one. I know Cisco devices have different port assignments, but I'm not sure how that applies to the WSA specifically. I'll have to make an educated guess and move on.
AM
Ammie
1 year ago
Hmm, I'm a bit unsure about this one. I know we need to use a vendor prefix for IE, but I'm not sure if -ms- or -o- is the right one. I'll have to double-check my notes.
GL
Glen
1 year ago
Hmm, I'm a bit unsure about this. I think the arbiter might monitor the gateway and notify the administrator if a critical error occurs, but I'm not totally sure.