You have a Microsoft Sentinel workspace named Workspace1.
You hire a security consultant. You provide the consultant with a guest account named User1 in your Microsoft Entra tenant You need to enable User1 to assign incidents in Workspace1.
Which roles should you assign to User1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Explanation:

Microsoft Entra role: Security Reader; Azure role: Microsoft Sentinel Responder Assigning incidents requires Sentinel incident-management permissions, which are provided by Microsoft Sentinel Responder at the workspace scope. Because the consultant is a guest user, Security Reader in Microsoft Entra gives the security-reader context commonly needed for security operations visibility without granting administrative tenant privileges. Sentinel Reader alone would allow viewing but not assignment.
Contributor-level Azure roles would be broader than necessary. In Microsoft Sentinel and Defender scenarios, collection, detection, investigation, and automation are separate functions. The selected answer maps to the function requested by the question rather than a neighboring capability. This is why analytics, hunting, workbooks, connectors, automation rules, and playbooks must not be treated as interchangeable. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Assign roles in Microsoft Sentinel; Microsoft Learn > Microsoft Sentinel built-in roles.

You have an Azure subscription that contains an Azure Key vault. The role assignments for the vault are shown in the following.

Explanation:

You have Microsoft Security Copilot agents that authenticate by using Microsoft Entra service principals.
You receive a Microsoft Defender alert triggered by the anomalous OAuth authentication of an agent ' s Microsoft Entra service principal.
You need to assess the impact of the agent identity and identify which resources are affected if the identity is abused for lateral movement The solution must minimize administrative effort.
What should you do?

• A. From Microsoft Purview Audit, query the audit logs for all the role assignments granted to the identity.
• B. From Attack paths, select the identity and view the blast radius.
• C. From Advanced hunting, create a query against the IdentityLogonEvents table to list all the sign-ins performed by the identity.
• D. From Incidents, review incidents related to OAuth events reported by Microsoft Defender for Cloud Apps.
• E. From AI Observability in Microsoft Purview Data Security Posture Management (DSPM), review the agent activity.

Explanation: Only visible for BraindumpsPass members. You can sign-up / login (it's free).

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals.
More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Sentinel workspace
You have a multi-tier Security Operations Center (SOC) team.
You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.
Solution: You create an analytics rule.
Does this meet the goal?

• A. Yes
• B. No

Explanation: Only visible for BraindumpsPass members. You can sign-up / login (it's free).

You have an Azure subscription named Sub1 that contains a storage account named storage1. Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has malware scanning enabled.
You need to configure a solution that automates the remediation of malware detected in storage1.
What should you include in the solution?

• A. Azure Policy
• B. Azure Logic Apps
• C. an alert rule
• D. a Log Analytics workspace

Explanation: Only visible for BraindumpsPass members. You can sign-up / login (it's free).