Microsoft Certified: Security Operations Analyst Associate Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose BE2

  B. Add the IP addresses to the corporate address range category In Microsoft Defender for Cloud Apps, defining corporate IP ranges: Marks locations as trusted Improves anomaly detection accuracy (e.g., impossible travel) Reduces false positives from known office locations E. Create an activity policy that has an exclusion for the IP addresses Even though: Impossible travel = anomaly policy (ML-based) 👉 In practice, alerts still surface as activities, and you can: Create an activity policy Add IP exclusions Prevent alert noise from those known ranges This is a supported way to suppress alerts when tuning alone (like sensitivity) isn’t sufficient.

• Chose AB2

  thats funny, chatGTP said BE, when I provided it with screenshot of this discussion it changed its answer to AB :D ...so to add little bit more to the confusion

• 1

  so B & E are the answers???