SC-200 Certification Practice Question #38

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint.

You need to identify any devices that triggered a malware alert and collect evidence related to the alert. The solution must ensure that you can use the results to initiate device isolation for the affected devices.

What should you use in the Microsoft 365 Defender portal?

Accepted Answer

The question's load-bearing phrase is "use the **results** to **initiate device isolation**." MS Learn's "Take action on advanced hunting query results" page explicitly states that from advanced hunting query results you can "Isolate affected devices to contain an infection" and "Collect an investigation package to obtain more forensic information," provided the results include the `DeviceId` column — exactly identify devices, collect evidence, and isolate, in one flow. Both the Suggested Answer and the largest community block (28 votes) choose D, and the only MS Learn-linked argument supports D. There is a substantial minority arguing A (Incidents) because an alert/incident already aggregates evidence and offers isolation, which is a defensible reading — so confidence is moderated to 80% rather than 90+. D wins on the "query the results, then act on them" wording and the official key.

More SC-200 practice questions