Microsoft Security Operations Analyst Associate SC-200 Practice Question

Create an alert-suppression rule from one of the existing "Malware detected in memory" alerts. Configure the rule to match the alert title and the file's hash or path so that only future alerts with the same title and matching file details are suppressed. This prevents repetition of the known false-positive alert while allowing Microsoft Defender's protection engines to continue scanning the file and raising other relevant alerts. Custom detection rules can only generate additional alerts, indicator "Allow" actions would suppress all future detections for the file (contrary to the requirement that new malicious activity must still be alerted on), and disabling the malware protection engine would stop all malware detections across the devices, which violates the requirement to keep other alerts active.