Microsoft Security Operations Analyst Associate SC-200 Practice Question

An alert suppression rule in Microsoft Defender XDR lets you define conditions (such as alert title, file name, file path, process command line, device group, or user) that, when met, automatically mark future matching alerts as Closed (False positive) without disabling the underlying detection logic. By scoping the rule to the specific command line used by the compliance-scanner script, only those alerts will be resolved automatically, while any new instance of the same alert triggered by a different script or path will still surface.

A custom detection rule (distractor) merely generates additional alerts and cannot auto-resolve system alerts. An antivirus exclusion or an ASR exception suppresses scanning or blocking for the executable but also prevents any future detection of malicious use of the same file or path, which fails the requirement to keep other instances of the alert active.