Microsoft SC-200 Exam Dumps

In Microsoft Sentinel, when you identify an alert as a false positive for a specific account, the most efficient way to suppress future alerts for that entity---without affecting others---is to use an automation rule.

Microsoft Sentinel documentation explains:

''Automation rules can automatically close incidents or suppress alerts based on conditions such as user, IP, or entity name. This helps reduce noise and prevent false positives without modifying analytics rules or affecting other entities.''

By configuring an automation rule to auto-close or suppress alerts where the username equals the known account, Sentinel will prevent new alerts for that account while continuing normal detection for others.

Other options are incorrect:

Watchlist (B) only stores reference data; it doesn't suppress alerts.

Modify analytics rule (C) affects all users, not just one account.

Activity templates (D) are used for entity behavior analysis, not alert suppression.

Correct answer: A. Create an automation rule

In Microsoft Sentinel, playbooks (Logic Apps) that are connected to Sentinel are most commonly run in context of an incident. From the Incidents blade, you select an incident, then choose Actions Run playbook to trigger a manual test against that specific incident's entities and alert context. This is the recommended way to validate playbook inputs (entities, alert details, incident properties) and permissions end-to-end without changing analytics rules. While the Playbooks blade shows the Logic Apps and their connections, the incident view is where Sentinel exposes manual execution with full security operations context (assignments, comments, evidence), which is what ''test a playbook manually in the Azure portal (from Sentinel)'' refers to.

For Microsoft Entra audit logs ingested into a Microsoft Sentinel workspace, the maximum retention period is determined by the workspace's analytics retention setting. Microsoft Sentinel workspaces support two retention tiers:

• Interactive retention: Data searchable and accessible in real-time (typically 30 days for free tier, up to 90 days with Log Analytics Workspace settings)
• Long-term retention: Data archived but still queryable through search

To maximize the retention of Microsoft Entra audit logs specifically in a Sentinel workspace, you should set the workspace analytics retention period to 90 days. This is the maximum retention period supported for hot storage in a Log Analytics workspace, which directly backs your Sentinel workspace. Beyond 90 days, data would require moving to a storage account for archival purposes, but within the workspace itself, 90 days represents the maximum retention setting available.

In Microsoft Defender for Endpoint, before administrators can allow or block user-specified IPs or URLs, the feature ''Custom network indicators'' must be enabled under Advanced Features in the Microsoft 365 Defender portal.

This capability allows defining Indicators of Compromise (IoCs) at the network level to enforce allow/block decisions for specific domains, URLs, or IP ranges. Once enabled, Defender for Endpoint agents enforce these network indicators across managed endpoints.

Other features like EDR in block mode or Web content filtering provide automatic blocking, not manual IP/URL control.

Correct Answer: B. custom network indicators

When dealing with frequent false positives in Microsoft Defender for Endpoint alerts, such as those triggered by legitimate Office macros, the best practice is to hide false alerts while maintaining overall protection.

Microsoft Defender documentation prescribes the following approach:

Generate the alert (E): The alert must first appear in the queue so it can be reviewed and correctly classified.

Hide the alert (B): Analysts can hide individual alerts to clean up the queue without disabling detections or reducing coverage.

Create a suppression rule scoped to a device group (D): To prevent recurrence, suppression rules should be scoped narrowly (such as to a device group like the accounting team's devices), maintaining the principle of least privilege and minimal impact.

Options A (Resolve automatically) and C (Suppress any device) would reduce visibility or broaden suppression excessively, potentially missing real threats.

This combination of actions aligns with Defender XDR's alert management best practices, ensuring a balance between reducing noise and preserving security posture.