Microsoft Security Operations Analyst Associate SC-200 Practice Question

The Microsoft Sentinel Contributor role grants permissions to create, edit, and delete content within Microsoft Sentinel, including analytic rules, hunting queries, workbooks, and playbooks, and to view and manage incidents. It does not grant permissions to delete the Log Analytics workspace or change its settings, which remain protected by the Log Analytics Contributor or Owner roles.

• Microsoft Sentinel Responder is limited to incident management actions and cannot create or edit analytic rules.
• Log Analytics Contributor provides broad rights to modify workspace configuration, exceeding the required scope.
• Microsoft Sentinel Reader is read-only and cannot create or modify analytic rules. Therefore, Microsoft Sentinel Contributor best satisfies the requirement.