Managing Microsoft 365 DLP Alert Status Lifecycle

Manage information security alerts and activities

Answer Correct answer: E — You can change the status of a Resolved DLP alert to Investigating, Active, or Dismissed to reflect ongoing or revised investigation needs.

You have a Microsoft 365 alert named Alert2 as shown in the following exhibit. exhibit You need to manage the status of Alert2. To which status can you change Alert2?

The status cannot be changed.
Dismissed only
Investigating only
Active or Investigating only
Investigating, Active, or Dismissed Correct Answer

Community Insight

The core concept tested is the flexibility of the alert workflow in Microsoft 365 Defender, where a 'Resolved' status is not final and can be reverted to Active, Investigating, or Dismissed.

This question addresses the lifecycle management of Microsoft Purview DLP alerts, specifically focusing on the ability to modify an alert's status from 'Resolved' back to other states. It establishes that users can reopen or dismiss resolved alerts based on new information.

Many candidates incorrectly assume that once an alert is marked as 'Resolved', its status is locked and cannot be changed (Option A), failing to recognize the need for re-investigation or false positive correction.

Community Discussion (8 comments)

NeerajSap 👍 1 Selected: E

In Microsoft 365 (Microsoft Purview/Defender alert management), an alert's status can be changed among the available alert states to reflect its investigation lifecycle. Even if the current status of Alert2 is Resolved (as shown in the exam exhibit), you can change it back to: Active Investigating Dismissed

spgrinch 👍 1 Selected: E

When an alert is created, its status is Active. As you review the details of each alert, you can update its status to any of the states listed below: Active: default state of the alert until its status is changed Investigating: alert is under investigation Resolved: the alert doesn't require further investigation or follow-up Dismissed: the alert isn't relevant or doesn't need investigation

rvln7 👍 4 Selected: E

correct: https://learn.microsoft.com/en-us/purview/compliance-manager-alert-policies

f2b34cb 👍 5 Selected: E

You can change a resolved alert in 365 DLP to the Dismissed or Active status. While the standard workflow moves an alert to a "resolved" state when it's handled, you can also dismiss it if it's not relevant or reopen it to an active status if further action is needed. Dismissed: Use this status if the alert is not relevant, was a false positive, or has already been dealt with in a way that doesn't require further investigation. Active: Revert an alert to this status if a review reveals that it was incorrectly resolved and requires more action. Investigating: This is a status to use when you are actively working on the alert.

Alcpt 👍 1 Selected: A

A resolved alert will not change its status, but the associated alert policy can still create new alerts if the triggering conditions are met again.

Alcpt 👍 2

Updating my answer to E Yes, you can change a Resolved alert's status back to Active, Investigating (or In Progress), or Dismissed within the Microsoft 365 portals. While "Resolved" signifies that an investigation is complete, you might need to change the status if new information emerges or if the issue recurs

Eltooth 👍 1 Selected: A

There is no clear answer to this as the official MS documentation has changed. "The official Microsoft documentation on the lifecycle of DLP alerts does not explicitly state that a resolved alert can never be reopened or changed to another status. However, it does describe the process as moving through stages like Trigger → Notify → Triage → Investigate → Remediate → Tune, and once remediation is complete, the alert is considered closed. The documentation emphasizes that the Microsoft Defender portal retains incidents for six months, and the DLP alert management dashboard retains alerts for 30 days, but it does not mention an option to revert a resolved alert back to an active state.1 So, while the statement you provided is mostly accurate in practice (resolved alerts are treated as final), Microsoft does not explicitly say “cannot be reopened” in the docs. It’s more about the workflow being designed for forward progression rather than reopening."

454252dfr 👍 3 Selected: E

Correct

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

In Microsoft Purview (formerly Compliance Manager) and Microsoft 365 Defender, the lifecycle of a Data Loss Prevention (DLP) alert allows for dynamic status updates. While an alert typically moves through states like Active -> Investigating -> Resolved, the system permits users to change the status of a Resolved alert if necessary. Specifically, you can change a resolved alert to Active (to reopen it for further investigation), Investigating (if it requires immediate attention again), or Dismissed (if it was a false positive or irrelevant). Therefore, all three statuses are valid targets for modification.

Why the Other Options Are Wrong

Option A is incorrect because the UI explicitly provides buttons or dropdowns to change the status of a resolved alert. Options B and C are incomplete; while you can dismiss or investigate, you are not limited to only one of those actions. Option D excludes 'Dismissed', which is a common action for resolved false positives, making it an incorrect constraint.

Community Comment Notes

Community consensus strongly supports Option E. As user f2b34cb noted, "You can change a resolved alert in 365 DLP to the Dismissed or Active status." User Alcpt confirmed this by stating, "Yes, you can change a Resolved alert's status back to Active, Investigating (or In Progress), or Dismissed within the Microsoft 365 portals." This aligns with official Microsoft documentation describing the alert workflow stages.

Official Reference

https://learn.microsoft.com/en-us/purview/compliance-manager-alert-policies

Exam Strategy

When dealing with Microsoft Purview alert questions, remember that 'Resolved' is a state that can be reversed. Do not assume 'Resolved' means 'Final'. Look for options that allow reopening (Active/Investigating) or dismissing, as these are standard operational needs in security incident response.

Frequently Asked Questions

Why can't I change a Resolved alert to anything else?

You can actually change it. Microsoft Purview allows reverting a Resolved alert to Active or Investigating if new evidence emerges, or to Dismissed if it was a false positive.

What is the difference between Dismissed and Resolved?

Resolved means the issue is handled but might still be relevant. Dismissed means the alert is irrelevant or a false positive. Both are terminal states, but Resolved can be reopened.

More SC-401 FAQ →

Related Analysis

← Back to SC-401 Study Guide