Exam SC-200 topic 2 question 24 discussion

In exam today (16 jan 2023)

Answer is correct. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules#create-a-suppression-rule

Outdated, thats why I got it wrong (it'll help me sleep at night)

Note: Azure Security Center is now Microsoft Defender for Cloud

Correct Ans

The answers are correct. "Select security alerts" -> "Suppression rule and create new suppression rule." In this case, "Entity type: Azure Resource" is optimal because of Azure Functions apps. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules#create-a-suppression-rule

On the exam July 7 2023

Understand that "select security alerts" means "go to security alerts page". "Select Suppression rules"= "select the suppression rules link at the top of the page" https://docs.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules

the sequence is correct

You can only select one security alert and create a supression rule for it. When selecting multiple security alerts and click 'Supression rules' then click 'Create new suppression rule', the drop down menu under Alerts (when selecting 'Custom') would allow you to select only one alert. That's why I find the answer wrong in terms of sequence of actions. Selecting the security alert (not alerts!) should be last.