Suppressing False Positive Alerts in Microsoft Defender for Endpoint

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender for Endpoint

Short answer

BDE Hide the alert, create a suppression rule scoped to a device group, and generate the alert to establish the baseline for suppression.

Question

Your company uses Microsoft Defender for Endpoint.
The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company's accounting team.
You need to hide false positive in the Alerts queue, while maintaining the existing security posture.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
  1. Resolve the alert automatically.
  2. Hide the alert. Correct Answer
  3. Create a suppression rule scoped to any device.
  4. Create a suppression rule scoped to a device group. Correct Answer
  5. Generate the alert. Correct Answer

Key Takeaways

The question tests the distinction between resolving (which keeps the alert visible) and hiding/suppressing (which removes it from view), along with the ability to scope suppression rules to device groups for targeted management.

This question tests the correct procedure for managing false positive alerts in Microsoft Defender for Endpoint by hiding them and creating scoped suppression rules. The page establishes that B, D, and E are the required actions to effectively manage alert noise without compromising security posture.

Common mistake: Many candidates incorrectly choose A (Resolve the alert) because they believe it clears the queue; however, resolved alerts remain visible in the queue history, failing the requirement to 'hide' false positives.

Expert Analysis

Why the Answer Is Correct

To hide false positives while maintaining security posture, you must first ensure the alert exists in the system to apply specific handling, which corresponds to generating or identifying the alert (E). Then, you explicitly hide the alert (B) to remove it from the active queue view. Finally, to prevent recurrence specifically for the accounting team's devices, you create a suppression rule scoped to a device group (D). This combination effectively silences the noise for that specific context.

Why the Other Options Are Wrong

Option A (Resolve the alert) is incorrect because resolved alerts stay in the Alerts queue marked as 'Resolved', violating the requirement to hide them. Option C (Create a suppression rule scoped to any device) is less precise than scoping to a device group when the target audience is a specific team like accounting, making D the better best-practice choice for targeted management.

Community Comment Notes

Community consensus strongly favors BDE. As Metasploit noted, "Resolved alerts stay in Alerts queue marked as resolved," explaining why A is wrong. KingSize highlighted the importance of targeting the "accounting team" via device groups. Jethi verified that suppression rules can indeed be created based on a device group, confirming D's validity.

Official Reference

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/alert-suppression?view=o365-worldwide

This link opens the official vendor documentation in a new tab.

Exam Strategy

Focus on the specific wording 'hide' versus 'resolve'. In Defender XDR, 'Hide' removes the alert from the queue entirely, whereas 'Resolve' leaves it in the queue but marks it as handled. Always look for scoping opportunities (like device groups) when a specific user segment is mentioned.

Frequently Asked Questions

Why is resolving the alert not the correct answer?

Resolving an alert keeps it visible in the Alerts queue with a 'Resolved' status. The question requires hiding the alert, which removes it from the queue entirely.

Can suppression rules be scoped to device groups?

Yes, modern Microsoft Defender for Endpoint allows suppression rules to be scoped to specific device groups, making it ideal for targeting specific teams like accounting.

More SC-200 FAQ →

Community Votes

BDE
55%
BD
25%
ABC
12%
CBD
8%

55% of anonymous learners picked answer BDE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 90 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 90

  1. KingSize 👍 60
    You can Hide or Resolve alert and all of those actions you can perform on any device or device groups or single device. But in question there is accounting team so there will be device group. Answer should be ABD
  2. jethi 👍 36
    Suppression rule can be created based on a device group. Verified it on the defender portal itself. Correct answer is BDE
  3. PTIN 👍 20
    Given answer BCE is correct. The question states "alerts must be hidden from queue". Automatically resolving is not correct solution as that will still show up in the queue. Hence given answer BCE is correct
  4. AlaReAla 👍 13
    it cannot be A as we need to hide, not resolve (so it should be B). I suppose it can to D, and E is anyhow the right option. So in all, ans should be BDE.
  5. Startkabels 👍 12
    It's about the alert queue in Defender so you need to general scope for any alerts that's about the Word documents containing macros. That the documents are often used on devices used by the Account team does not matter. It is about the document that you company uses. Also read the article cause it reads you can either hide or resolve and to hide is clearly what is asked here. So I go for BCE.
Show 25 more comments
  1. pedromonteirozikado 👍 12
    The documents are used on devices by the account team, the questions said to hide false positive alerts, and not all the alerts, so i think is BDE.
  2. Lone__Wolf 👍 11
    Here's a brief explanation of each option: E. Generate the alert: You need to generate the alert first so that you can see it in the Alerts queue. B. Hide the alert: After generating the alert, you can hide it if you want to remove it from view. D. Create a suppression rule scoped to a device group: You can also create a suppression rule scoped to a specific device group if you want to only apply it to a specific group of devices. This helps you maintain the existing security posture.
  3. Metasploit 👍 9
    BDE. This changed. I know, not in the docs(Docs are old and not updated). I had to go to the tech community. https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/introducing-the-new-alert-suppression-experience/ba-p/3562719
  4. Metasploit 👍 9
    Correction: BDE This question bugged me. The new alert suppression rules allows for much more. https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/introducing-the-new-alert-suppression-experience/ba-p/3562719
  5. Metasploit 👍 8
    NOT A = Resolved alerts stay in Alerts queue marked as resolved. B = You can hide alerts from the system. NOT C = Not best practice. D = Because, Best practice and New alert suppression rules allow for groups and much more(The docs are still old, below is a link for evidence to this claim) https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/introducing-the-new-alert-suppression-experience/ba-p/3562719 E = Because you cannot do either of the other without an alert.
  6. ArciOfficial 👍 8
    Given answer is CORRECT: 1. Generate the Alert - Used for next step 2. Create Suppression Rule for All Devices - This is the only setting that exists 3. Hide the Alert - Listed in documentation steps (See link) https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-alerts?view=o365-worldwide#suppress-an-alert-and-create-a-new-suppression-rule
  7. AnonymousJhb 👍 6
    D is wrong. This "group" feature is only available in Suppress alerts from Microsoft Defender for Cloud. This question context is for Manage Microsoft Defender for Endpoint alerts. There are two contexts for a suppression rule that you can choose from: -Suppress alert on this device -Suppress alert in my organization
  8. EricShon 👍 6
    B. Hide the alert (for immediate, manual action) D. Create a suppression rule scoped to a device group (for a targeted, long-term solution) E. Generate the alert
  9. teehex 👍 5
    Suppression rule can be assigned to a device group in a new unified Microsoft Defender 365 Portal. Go to Incidents & alert > Alert. Select an alert then click [...] > Create a suppression rule. From the panel you will have an option to select Device groups under Additional details. You wouldn't see this option in old article that was written about MDATP (old name)
  10. yyu018 👍 5
    Depends on where you access the Alert. If you access the alert from the new unified portal - MS security center (security.microsoft.com), you will have the Alerts on device groups option in Create suppression rule.
  11. PTIN 👍 5
    Apologies, the question does state that alerts must be hidden from alerts queue so the given answers are correct for the rule to trigger
  12. sadako 👍 5
    Sorry i was wrong. Correct shortcut should be: Resolve alert Hide alert Create supression rule to device group
  13. stromnessian 👍 5
    Terrible question but that's what you expect with MS exams.
  14. Ashfaq2 👍 5
    Suppression rule can not create based on Device Group
  15. tester18128075 👍 5
    Correct answer is BDE
  16. sasasach 👍 4
    I checked it in MS defender itself, you can create suppression rule based on device group
  17. rk4ai 👍 4
    BCE. Given answer is correct.
  18. Krayzr 👍 3
    (E): For a suppression rule to be created, an alert must exist to base it on. In this context, "generate the alert" implies ensuring that the alert related to the macros is present or triggered. Since the documents are used frequently, these alerts are likely already occurring, but selecting this action ensures there’s an alert to work with as the starting point. B): Once the alert is present, hiding it removes the current instance from the Alerts queue. This directly addresses the requirement to "hide false positive in the Alerts queue," ensuring it no longer appears as an active issue for the security team to review. (D): After hiding the current alert, creating a suppression rule tailored to the accounting team’s device group prevents future similar alerts from appearing in the queue for those devices. This maintains the security posture by keeping alerts active for other devices where the macros might not be legitimate.
  19. pedromonteirozikado 👍 3
    The documents are used by the Accounting team (They specified in the question, there's a reason for that), so creating a suppression rule for all devices, you'll be hiding real alerts. Correct answer is BDE. 1. Generate the Alert - Used for next step. 2. Create Suppression Rule for Account Team Device Group to the alert (In new 365 Defender, has 3 options for scope). 3. Hide the Alert.
  20. BhanuD 👍 3
    Hi, may be the documentation is not updated, the scope is to select organization or user/device/device groups, as they mentioned clearly as accounts department, device group need to be selected
  21. John0153 👍 3
    BCE is the correct answer "Documents are used "FREQUENTLY" on the devices of accounting" this doesn't mean that it is only restricted to accounting team
  22. ACSC 👍 3
    B - hide false positive D - devices of the company's accounting team E - while maintaining the existing security posture
  23. sadako 👍 3
    Shortcut for easier reference: Hide alert Create supression rule to device group Generate alert
  24. Nocturnal 👍 3
    Read link...not seeing suppression based on a group...only for a device or whole organization.
  25. Badr_j 👍 3
    B,D,E It is only for accounting team. (Device group)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Assigning the Microsoft Sentinel Responder role so a user can investigate incidents under least privilege

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide