Microsoft Security Operations Analyst Associate SC-200 Practice Question

In Microsoft 365 Defender, an alert suppression rule is designed to automatically close existing alerts and prevent new alerts that match the same conditions from appearing. When you scope a suppression rule to a specific entity-such as a file identified by its SHA-1 or SHA-256 hash-the rule applies only to alerts that involve that exact file across the selected device group or tenant. This stops the benign utility's alerts from cluttering the queue without affecting detections for other credential-dumping files.

Placing the hash on the antivirus allow list (also called an AV exclusion) prevents malware scanning actions but does not suppress alerts that originate from other Defender XDR components such as Endpoint detection rules. Lowering severity in a custom detection rule would not affect the built-in alert that is firing. Disabling a Microsoft Sentinel analytics rule is irrelevant because the alert is generated in Microsoft Defender XDR, not Sentinel.

Therefore, creating an alert suppression rule scoped to the file's SHA-256 hash is the correct solution.