SC-200 Certification Practice Question #236

Question

You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1.

You need to ensure that User1 can enable User and Entity Behavior Analytics (UEBA) for WS1. The solution must follow the principle of least privilege.

Which roles should you assign to User1? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Enabling UEBA requires two things per MS Learn: the Microsoft Entra ID **Security Administrator** role (Global Administrator would work but breaks least privilege; Security Operator is insufficient), and an Azure RBAC role on the workspace. The doc explicitly names **Microsoft Sentinel Contributor at the workspace level** as the *least privileged* option over Owner/Contributor — and at the workspace scope it pairs with Log Analytics Contributor, but among the three dropdown choices "Microsoft Sentinel Contributor" is the correct least-privilege selection (plain Contributor is broader; Automation Contributor only manages playbooks/automation). The Highly Voted community comments (11 and 5 👍) and Blasty's quoted prerequisites all align with the documentation, so confidence is high at 90%.

More SC-200 practice questions