SC-200 Exam Dumps | You have an Azure subscription that contains two users named User1 and User2 and a Microsoft Sentinel

<< Prev Question Next Question >>

Question 40/104

You have an Azure subscription that contains two users named User1 and User2 and a Microsoft Sentinel workspace named workspace1. You need to ensure that the users can perform the following tasks in workspace1:
* User1 must be able to dismiss incidents and assign incidents to users.
* User2 must be able to modify analytics rules.
The solution must use the principle of least privilege.
Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Recent Comments (The most recent comments are at the top.)

sam - Nov 26, 2024

All Microsoft Sentinel built-in roles grant read access to the data in your Microsoft Sentinel workspace.

Microsoft Sentinel Reader can view data, incidents, workbooks, and other Microsoft Sentinel resources.

Microsoft Sentinel Responder can, in addition to the above, manage incidents (assign, dismiss, etc.).

Microsoft Sentinel Contributor can, in addition to the above, create and edit workbooks, analytics rules, and other Microsoft Sentinel resources.

Microsoft Sentinel Playbook Operator can list, view, and manually run playbooks.

Microsoft Sentinel Automation Contributor allows Microsoft Sentinel to add playbooks to automation rules. It isn't meant for user accounts.

Question 40/104

Recent Comments (The most recent comments are at the top.)

LEAVE A REPLY

Download PDF File