nerdexam
Microsoft

SC-200 · Question #190

You have an Azure subscription that contains a virtual machine named VM1 and uses Microsoft Defender for Cloud. Microsoft Defender for Cloud has automatic provisioning configured to use Azure…

The correct answer is C. On VM1, trigger a PowerShell alert. To create a custom alert suppression rule in Microsoft Defender for Cloud, the alert you want to suppress must first exist in your alerts list. Suppression rules are created directly from an existing alert - you open the alert, then use the option to create a suppression rule…

Submitted by alyssa_d· Apr 18, 2026Manage threat mitigation using Microsoft Defender for Cloud

Question

You have an Azure subscription that contains a virtual machine named VM1 and uses Microsoft Defender for Cloud. Microsoft Defender for Cloud has automatic provisioning configured to use Azure Monitor Agent. You need to create a custom alert suppression rule that will suppress false positive alerts for suspicious use of PowerShell on VM1. What should you do first?

Options

  • AFrom Microsoft Defender for Cloud, export the alerts to a Log Analytics workspace.
  • BFrom Microsoft Defender for Cloud, add a workflow automation.
  • COn VM1, trigger a PowerShell alert.
  • DOn VM1, run the Get-MPThreatCatalog cmdlet.

How the community answered

(28 responses)
  • A
    11% (3)
  • B
    4% (1)
  • C
    82% (23)
  • D
    4% (1)

Explanation

To create a custom alert suppression rule in Microsoft Defender for Cloud, the alert you want to suppress must first exist in your alerts list. Suppression rules are created directly from an existing alert - you open the alert, then use the option to create a suppression rule based on its properties (entity, alert type, etc.). Therefore, the first step is to trigger the PowerShell alert on VM1 so that it appears in Defender for Cloud alerts. Only then can you select it and define a suppression rule to prevent future false positives of the same type from surfacing. Exporting alerts (A), adding workflow automation (B), or running Get-MPThreatCatalog (D) are not prerequisites for creating a suppression rule.

Topics

#Microsoft Defender for Cloud#Alert suppression#False positives#Security operations

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SC-200 Practice