Exam SC-200 topic 2 question 1 discussion

Answer is (B) No, because the question is asking for recommendations on the current alert that you are viewing(Mitigate the threat) and not on security recommendations in general(Prevent Future attacks) for the device associated with the alert.. https://learn.microsoft.com/en-us/azure/defender-for-cloud/managing-and-responding-alerts#respond-to-security-alerts (Mitigate the threat) - provides manual remediation steps for this security alert (Provides recommendations on what to do to resolve the alert) (Prevent future attacks) - provides security recommendations to help reduce the attack surface, increase security posture, and thus prevent future attacks.(Provides recommendations for security in general such as Remediate Vulnerabilities and win defender should be activated on all devices)

Answer is correct: https://docs.microsoft.com/en-us/azure/security-center/security-center-managing-and-responding-alerts

keyword in question is view recommendation. Which can only be possible to prevent future attacks

The "Prevent future attacks" section in Azure Security Center is designed to provide recommendations to address the root causes and prevent similar issues in the future. However, it does not directly mitigate current attacks. To address and mitigate current threats, you should focus on the "Mitigate threat" section. This section provides immediate actions to contain or neutralize the ongoing threat.

check this link guys it clearly showing the option in orevent future attacks Prevent future attacks - provides security recommendations to help reduce the attack surface, increase security posture, and thus prevent future attacks

Yes correct

In the question it asked for "to view recommendations to resolve the alert in Security Center." So, if you select Take Action, and then expand the Prevent future attacks section it will show the recommendations for the source machine not for the alert. So the answer will be : NO

I second the link shared by @examkid, Prevent future attacks doesn't resolve the current alert.

correct

Answer is Yes

Tried and tested The answer is A (Yes)

I believe the given answer is correct: NO I think that where the question refers to when mentioning recommendations for having the alert resolved is here and NOT the "Prevent future attacks" option. https://learn.microsoft.com/en-us/microsoft-365/security/defender/investigate-alerts?view=o365-worldwide#manage-alerts "The Recommendations tab provides next-step actions and advice for investigation, remediation, and prevention."

Yes, your solution meets the goal. In Azure Security Center, to view recommendations to resolve a security alert, you would typically follow these steps: Go to Azure Security Center. Navigate to the "Security alerts" section. Locate and select the specific alert you want to investigate. Click on "Take Action" or "View Recommendations" (the exact wording may vary). Expand the "Prevent future attacks" or similar section. In this section, you'll find recommendations provided by Azure Security Center to help you address the security issue that triggered the alert. These recommendations are designed to guide you in taking necessary actions to improve your security posture and mitigate the identified risks. So, selecting the alert, choosing "Take Action," and expanding the "Prevent future attacks" section is a valid approach to view recommendations and meet the goal of resolving the alert in Azure Security Center.

A. Yes, this solution meets the goal. From the Security alerts blade in Azure Security Center, you can select the alert that you want to investigate, and then select Take Action. The Take Action blade provides a list of recommendations that you can take to resolve the alert, including how to prevent future attacks. You can expand the Prevent future attacks section to view the recommendations.

Just a FYI Security Center is now called Defender for Cloud ( as far as I can tell ). There's also a Security Center under Azure -> Security but it doesn't seem to be the one referred to in this question.

Correct Mitigate the threat - provides manual remediation steps for this security alert Prevent future attacks - provides security recommendations to help reduce the attack surface, increase security posture, and thus prevent future attacks https://learn.microsoft.com/en-us/azure/defender-for-cloud/managing-and-responding-alerts

B is correct: https://docs.microsoft.com/en-us/azure/defender-for-cloud/tutorial-security-incident