SC-200 Practice Question 3670
Exam: SC-200
Domain: Manage a security operations environment
Difficulty: medium
You need to assign the least privileged built-in Azure RBAC role to a Tier-1 SOC analyst who must manage incidents, assign ownership, and change severity in Microsoft Sentinel, but must not create analytics rules or deploy automation playbooks. Which role should you assign?
Answer Options
A
Microsoft Sentinel Responder
B
Microsoft Sentinel Contributor
C
Microsoft Sentinel Reader
D
Global Administrator
Correct Answer
A: Microsoft Sentinel Responder
Explanation
The Microsoft Sentinel Responder role allows managing incidents (viewing, assigning, altering status and severity) without granting permissions to author analytics rules, data connectors, or playbooks.