SC-200 Exam - Question 186

Question

HOTSPOT-You have a Microsoft Sentinel workspace named sws1. You plan to create an Azure logic app that will raise an incident in an on-premises IT service management system when an incident is generated in sws1. You need to configure the Microsoft Sentinel connector credentials for the logic app. The solution must meet the following requirements:• Minimize administrative effort. • Use the principle of least privilege. How should you configure the credentials? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Examice · Accepted Answer

.

evilprime · Answer

guess it should be 'reader' with 'managed' 
see https://learn.microsoft.com/en-us/azure/sentinel/authenticate-playbooks-to-sentinel#authenticate-with-managed-identity

billo79152718 · Answer

A managed identity
Microsoft Sentinel Reader

ACSC · Answer

Answer is correct.
https://learn.microsoft.com/en-us/azure/sentinel/authenticate-playbooks-to-sentinel#authenticate-with-managed-identity
https://learn.microsoft.com/en-us/azure/sentinel/roles#microsoft-sentinel-specific-roles

donathon · Answer

A managed identity
Microsoft Sentinel Reader

Ramye · Answer

Based on the Sentinel role permission (RBAC), I think the answers are:
- Managed Identity
- Sentinel Responder  (because this can assign incident as outlined below)
 
Microsoft Sentinel Responder can, in addition to the above, manage incidents (assign, dismiss, etc.).

RV025 · Answer

I would say:
Service principle since that can be assigned the least privilege without having to create a user in the AD. 
Since no automation creation of incident handling is needed, sentinel reader role would suffice

SaHaGe · Answer

The same scenario tells you that the logic app is going to generate an incident. 
"You plan to create an Azure logic app that will raise an incident..."
The reader can only view incidents, the responder has the ability to generate them.
The suggested answer is correct.

chepeerick · Answer

Correct answer

smanzana · Answer

Managed identity 
Microsoft Sentinel Reader

chepeerick · Answer

Correct Option

kabooze · Answer

I hate these kind of questions. Honestly I can't tell what is "easier" a managed identity or a service principal. I know that the documentation says service principal is preffered.
Sigh....

a_kto_to · Answer

ChatGTP:
✅ Answer:
Role to assign:

Microsoft Sentinel Responder
Scope to assign the role:

Resource group that contains the Sentinel workspace
🧠 Explanation:

Microsoft Sentinel Responder

Can view incidents and update their status or comments, which is sufficient for triggering actions in a logic app when incidents are created.

Cannot create analytics rules, workbooks, or change workspace settings, so it aligns well with least privilege.

Scope at resource group level:

This limits the permissions to just the resource group that contains sws1, again helping follow least privilege.

SC-200 Exam - Question 186

Discussion