Microsoft Security Operations Analyst Associate SC-200 Practice Question

The Microsoft Sentinel Threat Intelligence Contributor role grants permission to import, update, and delete threat indicators, yet it does not allow the holder to modify analytics rules, incidents, automation rules, or playbooks. By assigning this role at the workspace scope, the Tier-2 analyst gains the required threat-indicator management capabilities without getting broader configuration or incident-management privileges. Microsoft Sentinel Contributor would be overly permissive because it includes rights to author analytics rules and playbooks, whereas Microsoft Sentinel Responder and Microsoft Sentinel Reader are insufficient because they do not allow changing threat-indicator data.