SHA generated a CONFIDENTIAL_COMPUTING_DISABLED finding. What is an appropriate quick remediation?

• A. Delete the offending VM and mute the finding.
• B. Delete the offending VM and disable the SHA detector.
• C. Delete the offending VM and manually mark finding inactive.
• D. Delete the offending VM and allow the finding to be automatically marked inactive.

Answer: (D)

When Security Health Analytics raises a finding, its lifecycle often resolves automatically when the underlying resource no longer exists. For a CONFIDENTIAL_COMPUTING_DISABLED finding, removing the offending VM eliminates the condition that triggered the alert. Deleting the resource lets the system automatically mark the finding as inactive, which is the quickest and most reliable way to close the issue without adding manual steps like muting or marking inactive yourself. Disabling the detector or muting/manual inactivation hides or delays the signal and is not advisable for ongoing visibility, while deleting the VM and letting auto-inactivation occur aligns remediation with the actual state of the environment. If you plan to keep or reconfigure the VM, you’d address the confidentiality setting directly, but for a fast remediation, deleting the VM and relying on automatic inactivation is best.