SC-200 Certification Practice Question #11

Question

Your company deploys the following services:
✑ Microsoft Defender for Identity
✑ Microsoft Defender for Endpoint
✑ Microsoft Defender for Office 365
You need to provide a security analyst with the ability to use the Microsoft 365 security center. The analyst must be able to approve and reject pending actions generated by Microsoft Defender for Endpoint. The solution must use the principle of least privilege.
Which two roles should assign to the analyst? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement is narrowly scoped to actions **generated by Microsoft Defender for Endpoint** under the principle of least privilege. MS Learn's MDE RBAC permission list shows the **Active remediation actions** role explicitly grants "approve or dismiss pending remediation actions," which is exactly the device-action requirement — option B. To use the Microsoft 365 security center at all, the analyst needs a portal-access role; **Security Reader** (D) is the least-privileged Entra role that grants read access to the unified portal. The official Suggested Answer lists only D, which is incomplete (it provides portal access but not the approve/reject capability), so B is required to complete the solution — matching the dominant 20-vote community consensus for BD. The competing BC view relies on the Action Center doc that names Security Administrator, but that role confers broad admin rights well beyond approving/rejecting and therefore fails least privilege; the purpose-built MDE role is the least-privilege path. Confidence is held at 84% because the official Suggested Answer (D-only) and a notable BC minority disagree with the chosen BD, though MS Learn and the weight of community voting clearly favor BD.

More SC-200 practice questions