SC-200 Certification Practice Question #53

Question

You have a Microsoft 365 subscription that uses Azure Defender.
You have 100 virtual machines in a resource group named RG1.
You assign the Security Admin roles to a new user named SecAdmin1.
You need to ensure that SecAdmin1 can apply quick fixes to the virtual machines by using Azure Defender. The solution must use the principle of least privilege.
Which role should you assign to SecAdmin1?

Accepted Answer

Applying a "quick fix" is the Defender for Cloud **Fix** action on a security recommendation, and the permissions matrix shows that action requires the Contributor or Owner role — the built-in Security Reader and Security Admin roles cannot apply it. Since the 100 VMs all live in RG1, granting Contributor scoped to RG1 confers exactly the ability to remediate those VMs and nothing broader, satisfying the principle of least privilege. The subscription-level Contributor (B) and the Owner role on RG1 (D) both also grant the capability but exceed the minimum scope/privilege, and Security Reader (A) is read-only and cannot remediate at all. The official Suggested Answer, an overwhelming 33-vote community consensus, and the MS Learn roles table all converge on C.

More SC-200 practice questions