SC-200 Certification Practice Question #162

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint.

You have the on-premises devices shown in the following table.

You are preparing an incident response plan for devices infected by malware.

You need to recommend response actions that meet the following requirements:

•	Block malware from communicating with and infecting managed devices.
•	Do NOT affect the ability to control managed devices.

Which actions should you use for each device? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The requirements are (1) block malware from communicating with/infecting managed devices and (2) not lose the ability to control managed devices. For Device1 (managed Windows Server 2022), **isolation** is the correct action because, per MS Learn, isolation disconnects the device from the network *while retaining connectivity to the Defender for Endpoint service* — so control is preserved — and you pair it with Initiate Automated Investigation; the Contain action is not available for managed/onboarded devices. For Device2 (unmanaged Linux), only **Contain device** applies: containment is specifically the action for an unmanaged compromised device, instructing all onboarded Defender for Endpoint devices to block incoming and outgoing communication with it, which stops it from infecting the managed estate. The two strongest community answers (wheeldj 20👍, talosDevbot 10👍) agree exactly with this mapping and with MS Learn. Confidence is 86% rather than higher because there is no official Suggested Answer shown and a couple of low-vote dissenting rows, but the docs cleanly resolve the option availability for managed vs unmanaged devices.

More SC-200 practice questions