Exam SC-200 topic 1 question 26 discussion

Answer is correct, but the justification provided is not quite accurate. User1: Owner User2: Contributor You can't choose 'Security Admin' because the key in the questions is 'at the subscription level'. Read the Security Admin section in the documentation https://docs.microsoft.com/en-us/azure/defender-for-cloud/permissions At the Subscription Level, only Contributor and Owner can : - Apply security recommendations - Add/Assign initiatives - Edit security policy - Dismiss alerts However, only the Owner can 'Enable auto provisioning'... to be the owner of the extension you're deploying. "For auto provisioning, the specific role required depends on the extension you're deploying." Check the section under the roles table https://docs.microsoft.com/en-us/azure/defender-for-cloud/permissions All roles can 'view' alerts and recommendations.

Wouldn't this be contributors for both? https://docs.microsoft.com/en-us/azure/defender-for-cloud/permissions#roles-and-allowed-actions

user1: Contributor user2: Security Reader user1, Don't need to be an owner or Security Administrator to do the mentioned tasks. user2, only needs to read and apply security recommendations and dismiss alerts, Hence, Seucirty reader is the only option

The other give away in this question is security administrator no such thing so you can easily rule that out . Its actually security admin in Azure AD RBAC role

Is Security Administrator a typo? There's an Entra AD role named that but RBAC is "Security Admin"

correct

User 1: Owner User 2: Contributor Keyword: at subscription level Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/permissions

At subscription level only owner can 'Add/assign initiatives (including) regulatory compliance standards)'. Answer is correct.

Correct answer: User 1: contributor User 2: contributor

Apology. Security Administrator is not correct for user 1. It's not applied at the subscription level.

Security Administrator is also correct for user 1. Security Admin can Add/assign initiatives (including) regulatory compliance standards)

At the given reference URL… Contributor can also assign initiatives… So… Contributor for both!

The solution must use the principle of least privilege.... contributor priviledge is lower than owner I suppose, if so the first one why don't select contributor ?

Solution is correct. Owner and Contributor are required. If you enable Auto Provisioning, there are resources that require you to be Owner on that subscription. Details here: https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-loganalytic#availability

Contributor on subscription role for both. Remember that big difference between Contributor and Owner is that Owner also has access to modify RBAC (which is not required here, and will not adhere to Principle of Least Privilege)

Right answer is contributor for both: Action Security Reader / Reader Security Admin Contributor / Owner Contributor Owner (Resource group level) (Subscription level) (Subscription level) Add/assign initiatives (including) regulatory compliance standards) - - - ✔ ✔ https://docs.microsoft.com/en-us/azure/defender-for-cloud/permissions It's right there in the link. Remember, it asking at the subscription level.

Given answer is correct. Key part is "at the subscription level" Security admin only has access in Defender for cloud and not other Azure services https://docs.microsoft.com/en-us/azure/defender-for-cloud/permissions