SC-200 Certification Practice Question #141

Question

You have an Azure subscription that uses Microsoft Sentinel and contains a user named User1.

You need to ensure that User1 can enable User and Entity Behavior Analytics (UEBA) for entity behavior in Azure AD. The solution must use the principle of least privilege.

Which roles should you assign to User1? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

MS Learn's "Enable UEBA" prerequisites require the **Security Administrator** Microsoft Entra ID role plus an Azure role, where the explicitly *least-privileged* option is **Microsoft Sentinel Contributor** (the alternatives Owner/Contributor grant broader access). The image's two dropdowns map directly onto these two requirements, and Microsoft Sentinel Contributor is the only Sentinel-scoped contributor option offered. Community comments converge on this pair (mali1969 4 👍, uday1985 2 👍, smanzana, chepeerick 3 👍 "correct"), and the Highly Voted SJHCI (6 👍) endorses the answer with the same UEBA doc link. No credible dissent, so confidence is high.

More SC-200 practice questions