SC-200 Certification Practice Question #66

Question

You have a suppression rule in Azure Security Center for 10 virtual machines that are used for testing. The virtual machines run Windows Server.
You are troubleshooting an issue on the virtual machines.
In Security Center, you need to view the alerts generated by the virtual machines during the last five days.
What should you do?

Accepted Answer

A suppression rule does not delete alerts — it sets their status to Dismissed, and per MS Learn the alert "still appears in the security alerts list" but is hidden from the default (active) view. Because the question only asks to view the alerts already generated in the last five days, the correct action is to modify the Security alerts page filter to show Dismissed alerts (C). Disabling the rule (B) only affects future alerts — MS Learn states that deleting or changing a suppression rule "doesn't change the status of alerts that the rule already dismissed," so it would not retroactively reveal the past five days. Changing the expiration date (A) likewise affects only the rule's lifetime, and viewing Windows event logs (D) is off-topic for viewing Security Center alerts. The community is decisive (36 votes, a 59-👍 top comment), Suggested Answer agrees, and MS Learn confirms the dismissed-but-still-listed behavior.

More SC-200 practice questions