Exam MS-101 topic 2 question 25 discussion

Actual exam question from Microsoft's MS-101

Question #: 25
Topic #: 2

HOTSPOT -
Your company uses Microsoft Defender for Endpoint.
The devices onboarded to Microsoft Defender for Endpoint are shown in the following table.

The alerts visible in the Microsoft Defender for Endpoint alerts queue are shown in the following table.

You create a suppression rule that has the following settings:
✑ Triggering IOC: Any IOC
✑ Action: Hide alert
✑ Suppression scope: Alerts on ATP1 machine group
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

A suppression rule will not affect alerts that are already in the alerts queue. Only new alerts will be suppressed.

by ZuluHulu at Oct. 26, 2021, 10:45 a.m.

Comments

Submit Cancel

MartiFC

Highly Voted 3 years, 8 months ago

When a suppression rule is created, it will take effect from the point when the rule is created. The rule will not affect existing alerts already in the queue, prior to the rule creation. The rule will only be applied on alerts that satisfy the conditions set after the rule is created. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-alerts?view=o365-worldwide So, I tink that the answers are Y,Y,N

upvoted 18 times

...

Goena

Highly Voted 3 years, 6 months ago

- Yes, alert 1 was already created before suppression was enabled. It won't be suppressed retroactively. - Yes, Alert 3 was already created and doesn't apply. Either way, it will still show up. - No, the suppression rule is already in place before the alert can be created.

upvoted 6 times

...