Microsoft Security Operations Analyst Associate SC-200 Practice Question

When you create a suppression rule in Microsoft Defender XDR, you can scope it by alert title only, by alert title and entities, or by specific devices/users. Selecting the "alert title and entities" scope lets you add entity conditions-such as the file path of lsass.exe-to the rule. This hides future alerts only when the alert name and the specified entity values match (here, the full file path), so the benign LOB utility is suppressed everywhere, but genuine occurrences of the same alert from other paths continue to raise alerts. Scoping by alert title alone would silence every instance of that alert, while scoping by device or user would fail to cover all machines where the LOB utility runs.