Microsoft Certified: Security Operations Analyst Associate Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose ABD2

  can not choose E, why we need to generate more alert while we need to hide alert

• 3

  A B D is correct

• Chose ADE1

  A. Resolve the alert automatically ✅ ✔ Helps clean up alerts without disabling protection ✔ Keeps security controls active B. Hide the alert ❌ ✖ Not a proper/structured solution for ongoing false positives ✖ Doesn’t scale or manage future alerts effectively C. Create a suppression rule scoped to any device ❌ ✖ Too broad → weakens security posture across the environment D. Create a suppression rule scoped to a device group ✅ ✔ Limits suppression only to accounting devices ✔ Maintains overall security posture E. Generate the alert ✅ ✔ Needed as part of suppression rule configuration (you define conditions based on the alert)