SC-200 Certification Practice Question #4

Question

Your company uses Microsoft Defender for Endpoint.
The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company's accounting team.
You need to hide false positive in the Alerts queue, while maintaining the existing security posture.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement is to hide false positives in the queue while preserving the existing security posture for everyone except the accounting team's devices. E (generate the alert) is the necessary precondition — a suppression rule must be based on an existing alert type. B (hide the alert) is the action that removes the false positive from the Alerts queue without changing protection; MS Learn confirms "Hide alert" suppresses the alert and is specific to Defender for Endpoint, whereas "Resolve" (option A) leaves the alert in the queue marked resolved and so fails the "hide from queue" ask. D scopes the suppression to the accounting device group, which keeps the rule from weakening posture on every other device — unlike C (any device), which is too broad. The official Suggested Answer letter is only E (a single partial), but the overwhelming community vote (61 for BDE) plus a verified-in-portal comment and the current device-group suppression capability make BDE the answer. Confidence is held at 85 rather than higher because the docs that explicitly enumerate device-group scope for endpoint suppression are sparse (the community relies partly on a Tech Community blog), and a vocal minority pushed A/C.

More SC-200 practice questions