SC-200 Certification Practice Question #65

Question

You use Azure Security Center.
You receive a security alert in Security Center.
You need to view recommendations to resolve the alert in Security Center.
What should you do?

Accepted Answer

The goal is to resolve the alert you already received, which means you need remediation steps for the current threat. MS Learn is explicit: under Take Action, the "Mitigate the threat" section "provides manual remediation steps for this security alert," whereas "Prevent future attacks" only "provides security recommendations to help reduce the attack surface... and prevent future attacks." Answer B (Mitigate the threat) is therefore the recommendations that resolve the current alert; answer A (Prevent future attacks) is about hardening against future attacks. The dissent for A leans on two points: (1) A explicitly includes "select the alert" while B's wording omits it, and (2) the phrase "view recommendations" sounds like the recommendations section. Both are weaker than the doc's plain mapping — selecting the alert is an implicit prerequisite for any Take Action path, and the alert-resolving recommendations live under Mitigate the threat. Confidence is held at 84 rather than higher because of the genuine, well-argued A minority (the wording-of-A ambiguity is real), but Suggested Answer, the top 24-👍 comment, and MS Learn all converge on B.

More SC-200 practice questions