AZ-500 Question 258
Select 2Your organization is receiving recurring alerts in Microsoft Defender for Cloud about suspicious connections from a known internal automation script that connects from various external IP addresses for monthly patching tasks. The security operations team wants to reduce alert noise while still maintaining coverage for legitimate threats on the involved virtual machines. Which two actions should you take to handle these alerts effectively?
- A
Create a suppression rule in Microsoft Defender for Cloud to filter out alerts triggered by the known script.
- B
Lower the subscription's overall Security Policy from Standard to Free to reduce the alert volume.
- C
Mark each alert as 'Dismissed,' ensuring future alerts based on the same behavior do not reappear.
- D
Configure an Azure Logic Apps playbook to automatically apply remediation for all alerts associated with that automation script.
- E
Implement Adaptive Application Controls or custom allowlists to recognize the script as a safe process.
Show answer and explanation
Correct answers: A, E
Explanation
In Microsoft Defender for Cloud, you can manage repetitive or benign alerts through suppression rules or by marking trusted processes as safe using Adaptive Application Controls. Suppression rules remove alert noise from known, harmless events, while safe process configurations ensure that these processes are not flagged in the future. For more information, refer to Microsoft Defender for Cloud documentation on creating custom alert rules and configuring application controls.
- A. Correct.
Option 1 is correct because creating a suppression rule for a known benign script helps eliminate false positives while preserving broader threat detection capabilities.
- B. Incorrect.
Option 2 is incorrect because switching to the Free tier significantly reduces security features and coverage, which could lead to missing critical threats. This approach does not address the specific alert noise problem effectively.
- C. Incorrect.
Option 3 is incorrect because dismissing an alert only applies to the current occurrence and does not prevent future alerts of the same nature. Repeated alerts can still be generated unless you specifically suppress them or configure safe processes.
- D. Incorrect.
Option 4 is incorrect because automatically remediating all alerts triggered by the script could mask legitimate threats if an attacker mimics the script's behavior. It also doesn't specifically reduce false positives, it just automates responses.
- E. Correct.
Option 5 is correct because adding the known script to an allowlist via Adaptive Application Controls (or other safe process configuration) ensures Defender for Cloud recognizes ongoing usage as benign, reducing unnecessary alerts.