MENU
Your company uses Microsoft Defender for Endpoint.
The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company's accounting team.
You need to hide false positive in the Alerts queue, while maintaining the existing security posture. Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Suggested Answer: B, C, E
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
11 comments · newest first
KA
Kami
12 months ago
Not sure about A, resolving automatically could backfire.
OL
Olga
1 year ago
C is the way to go, scoped rules are essential!
LA
Laura
1 year ago
Wait, can we really just hide alerts? Seems risky.
LE
Lettie
1 year ago
I think B is a good choice too.
DO
Donte
1 year ago
Definitely go for D, that makes sense!
LE
Leonida
1 year ago
I practiced a similar question where we had to manage alerts, and I think creating a suppression rule scoped to a device group makes the most sense for our accounting team.
MO
Monte
1 year ago
I feel like resolving the alert automatically could lead to missing actual threats, so I’m leaning towards creating a suppression rule instead.
PH
Phyliss
1 year ago
I think hiding the alert might be a quick fix, but it doesn't really help with the overall security posture, right?
BR
Brett
1 year ago
I remember we discussed suppression rules in class, but I'm not sure if they should be scoped to any device or a specific device group.
MA
Magdalene
1 year ago
Dynamic Content sounds like the right answer to me. That's the Marketo feature that needs to be approved before it can be used, if I remember correctly.
RU
Rueben
1 year ago
Hmm, I'm a bit unsure about this one. I know the iteration terminal has something to do with the loop, but I can't quite remember the exact details. I'll have to think this through carefully.