SC-200 Certification Practice Question #48

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.

You discover that when Microsoft Defender for Endpoint generates alerts for a commonly used executable file, it causes alert fatigue.

You need to tune the alerts.

Which two actions can an alert tuning rule perform for the alerts? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

Accepted Answer

An alert tuning rule in Microsoft Defender XDR can perform exactly three actions when its conditions are met: Hide alert, Resolve alert, and Set as behavior. Of the offered choices, only B (hide) and C (resolve) are valid rule actions, and both directly address alert fatigue from a commonly used executable — hide suppresses the alert and prevents incident creation, while resolve auto-resolves matching alerts. MS Learn confirms these as the rule actions, and a 6-vote community majority plus a 3-👍 explanation back BC. The Suggested Answer lists only C, but the question asks for two actions and the docs clearly support B as the second; this Suggested-vs-community gap is the reason confidence is 90 rather than higher, but MS Learn resolves it firmly in favor of BC. Delete, merge, and assign are not alert-tuning capabilities.

More SC-200 practice questions