Exam SC-200 topic 3 question 11 discussion

Roles for working in Azure Sentinel Azure Sentinel-specific roles All Azure Sentinel built-in roles grant read access to the data in your Azure Sentinel workspace. Azure Sentinel Reader can view data, incidents, workbooks, and other Azure Sentinel resources. Azure Sentinel Responder can, in addition to the above, manage incidents (assign, dismiss, etc.) Azure Sentinel Contributor can, in addition to the above, create and edit workbooks, analytics rules, and other Azure Sentinel resources. Azure Sentinel Automation Contributor allows Azure Sentinel to add playbooks to automation rules. It is not meant for user accounts. Correct answer is Azure Sentinel Responder.

Answer is correct. Using the least privilege principle Microsoft Sentinel Responder is the best role to assign this user

All Microsoft Sentinel built-in roles grant read access to the data in your Microsoft Sentinel workspace. Microsoft Sentinel Reader can view data, incidents, workbooks, and other Microsoft Sentinel resources. Microsoft Sentinel Responder can, in addition to the permissions for Microsoft Sentinel Reader, manage incidents like assign, dismiss, and change incidents. Microsoft Sentinel Contributor can, in addition to the permissions for Microsoft Sentinel Responder, install and update solutions from content hub, and create and edit Microsoft Sentinel resources like workbooks, analytics rules, and more. Microsoft Sentinel Playbook Operator can list, view, and manually run playbooks. Microsoft Sentinel Automation Contributor allows Microsoft Sentinel to add playbooks to automation rules. It isn't meant for user accounts.

https://learn.microsoft.com/en-us/azure/sentinel/roles

Responder

IMHO the answer is A.

Correct!

correct