SC-200 Certification Practice Question #69

Question

You have an Azure Functions app that generates thousands of alerts in Azure Security Center each day for normal activity.
You need to hide the alerts automatically in Security Center.
Which three actions should you perform in sequence in Security Center? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Select and Place:

Accepted Answer

MS Learn's "Create a suppression rule" procedure lays out exactly three meaningful actions in order: navigate to **Security alerts**, choose **Suppression rules → Create new suppression rule**, then scope the rule with an **entity condition**. Because the noise comes from an Azure Functions app — an Azure resource — the correct entity condition is **Azure Resource + Resource ID**, not IP. The Highly Voted ACSC comment (12 👍) endorses the shown order and links the same doc, and trashbox explicitly justifies the Azure Resource entity type for a Functions app. The Pricing & settings, Security policy, and IP-entity tiles are distractors. Confidence is 87 (not higher) because this is a community-resolved drag-drop with no official answer image and a minor dissent about single vs multiple alert selection, though that dissent does not change the three-action sequence.

More SC-200 practice questions