SC-200 Practice Question 3696
Exam: SC-200
Domain: Manage a security operations environment
Difficulty: medium
Which built-in role in Microsoft Sentinel allows a security automation engineer to create and edit Azure Logic Apps playbooks triggered by Sentinel incidents?
Answer Options
A
Logic App Contributor combined with Microsoft Sentinel Contributor
B
Microsoft Sentinel Reader
C
Billing Administrator
D
Security Reader
Correct Answer
A: Logic App Contributor combined with Microsoft Sentinel Contributor
Explanation
The Microsoft Sentinel Playbook Operator role allows running playbooks, but editing and creating playbooks requires the Logic App Contributor role combined with Sentinel Contributor.