SC-200 Certification Practice Question #242

Question

You have a Microsoft 365 subscription that contains a user named User1 and two Windows devices named Device1 and Device2. Device1 and Device2 are onboarded to Microsoft Defender for Endpoint.

The following events occur.

•	User1 signs in to Device1.
•	Automatic attack disruption in Microsoft Defender XDR responds to an attack on Device1 and contains User1.
•	User1 attempts to connect to Device2.

Which protocols will Device2 block when User1 attempts to connect to Device2?

Accepted Answer

After attack disruption contains User1 on Device1, the containment is enforced on every onboarded device the user touches. When User1 then attempts to reach Device2, Device2 (an onboarded MDE device) blocks the incoming traffic for the attack-related protocols. MS Learn's "Contain user from the network" explicitly lists network logons, RPC, SMB, and RDP, and the DisruptionAndResponseEvents table has dedicated block events for RPC, SMB, RDP, and logons. Since only option F includes all three named protocols (RDP, RPC, SMB), and the Suggested Answer plus a unanimous Most Voted (8) plus two ~3 👍 comments all agree with the docs, confidence is high.

More SC-200 practice questions