Microsoft Security Operations Analyst Associate SC-200 Practice Question

The Microsoft Sentinel Responder role is designed for users who need to handle incidents without changing Microsoft Sentinel configuration. It lets a user view incidents and their evidence, assign incidents, change their status or severity, and run playbooks that are attached to incidents. It does not grant permissions to create or modify analytics rules, workbooks, or new playbooks, nor does it allow changes to the workspace or resource-group settings.

Microsoft Sentinel Reader is insufficient because it allows only read-only access, preventing incident response actions such as changing status or running playbooks.
Microsoft Sentinel Contributor exceeds the requirement; it permits creating and editing analytics rules, hunting queries, and playbooks, which violates the restriction.
Security Admin is an Azure RBAC role unrelated to Microsoft Sentinel specifics and provides broader permissions over security resources than required.
Therefore, Microsoft Sentinel Responder is the least-privilege role that satisfies the scenario.