Exam SC-200 topic 2 question 48 discussion

Actual exam question from Microsoft's SC-200

Question #: 48
Topic #: 2

You have an Azure subscription that contains a virtual machine named VM1 and uses Microsoft Defender for Cloud.

Microsoft Defender for Cloud has automatic provisioning configured to use Azure Monitor Agent.

You need to create a custom alert suppression rule that will suppress false positive alerts for suspicious use of PowerShell on VM1.

What should you do first?

A. From Microsoft Defender for Cloud, export the alerts to a Log Analytics workspace.
B. From Microsoft Defender for Cloud, add a workflow automation.
C. On VM1, trigger a PowerShell alert.
D. On VM1, run the Get-MPThreatCatalog cmdlet.

Show Suggested Answer

Suggested Answer: C 🗳️

by GeoPoi at May 9, 2023, 8:33 a.m.

Comments

Submit Cancel

peponokefalos

Highly Voted 1 year, 1 month ago

Correct answer is C. In order to deploy a suppression rule, you must first trigger an alert.

upvoted 8 times

...

Gurulee

Most Recent 11 months, 1 week ago

C Alert types that were never triggered on a subscription or management group before the rule was created won't be suppressed. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules#create-a-suppression-rule

upvoted 1 times

...