- A
Set the automation level for device isolation to 'Semi - require approval for any remediation'
Why wrong: This level requires a manual approval step before isolation, not automatic.
- B
Set the automation level for device isolation to 'Full - remediate threats automatically'
Full automation means the system automatically takes action (including device isolation) without waiting for approval.
- C
Create a custom detection rule that automatically isolates the device
Why wrong: Custom detection rules can trigger alerts but not directly perform automated isolation; AIR automation levels control the response.
- D
Enable 'Automated device isolation' in the Microsoft 365 Defender settings
Why wrong: There is no separate toggle for automated device isolation; it is controlled by the automation level for specific playbooks.
Quick Answer
The answer is to set the automation level for device isolation to 'Full - remediate threats automatically' in Microsoft Defender for Endpoint's automated investigation and response (AIR) configuration. This setting is correct because it enables the system to automatically isolate a device from the network when a high-severity malware alert is generated, bypassing the need for a security analyst to manually approve the action. The automation level dictates how aggressively AIR executes remediation steps, and the 'Full' tier is specifically designed to handle high-severity threats by immediately applying actions like device isolation based on the alert's severity and the device's risk level. On the MS-102 exam, this question tests your understanding of the granular automation levels within AIR policies, often tripping candidates who confuse 'Full' with 'Semi' or overlook that device isolation is a separate toggle from other remediation actions. A helpful memory tip is to associate "Full" with "Full autonomy"—when you need to automatically isolate a device without approval, you must crank the automation level all the way to Full.
MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
This MS-102 practice question tests your understanding of manage security and threats by using microsoft defender xdr. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: aIR automation levels control how Microsoft 365 Defender responds to threats.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator wants to configure automated investigation and response (AIR) in Microsoft 365 Defender so that when a high-severity malware alert is generated for a device from Microsoft Defender for Endpoint, the device is automatically isolated from the network without requiring a security analyst to approve the action. Which configuration step is required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Set the automation level for device isolation to 'Full - remediate threats automatically'
Option B is correct because setting the automation level for device isolation to 'Full - remediate threats automatically' in Microsoft Defender for Endpoint's automated investigation and response (AIR) configuration allows the system to automatically isolate a device when a high-severity malware alert is triggered, without requiring analyst approval. This automation level is specifically designed to execute remediation actions like device isolation immediately based on the alert's severity and the device's risk level.
Key principle: AIR automation levels control how Microsoft 365 Defender responds to threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the automation level for device isolation to 'Semi - require approval for any remediation'
Why it's wrong here
This level requires a manual approval step before isolation, not automatic.
- ✓
Set the automation level for device isolation to 'Full - remediate threats automatically'
Why this is correct
Full automation means the system automatically takes action (including device isolation) without waiting for approval.
Related concept
AIR automation levels control how Microsoft 365 Defender responds to threats.
- ✗
Create a custom detection rule that automatically isolates the device
Why it's wrong here
Custom detection rules can trigger alerts but not directly perform automated isolation; AIR automation levels control the response.
- ✗
Enable 'Automated device isolation' in the Microsoft 365 Defender settings
Why it's wrong here
There is no separate toggle for automated device isolation; it is controlled by the automation level for specific playbooks.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse the 'Full' automation level with requiring approval for all actions, or they mistakenly think a separate toggle like 'Automated device isolation' exists, when in fact the automation level controls all remediation actions including isolation.
Detailed technical explanation
How to think about this question
Under the hood, Microsoft Defender for Endpoint uses a risk-based automation level system where 'Full' applies to high-confidence alerts and triggers immediate remediation actions like device isolation, which leverages the Windows Filtering Platform (WFP) to block all network traffic except to the Microsoft Defender for Endpoint cloud service. This automation level is configured per device group, allowing granular control based on device criticality, and the isolation action is logged in the Action Center for post-event review. In a real-world scenario, a finance department's critical server might be set to 'Semi' to require approval, while standard workstations can be set to 'Full' for rapid containment of malware outbreaks.
KKey Concepts to Remember
- AIR automation levels control how Microsoft 365 Defender responds to threats.
- 'Full' automation allows the system to remediate threats without human approval.
- Device isolation is a common automated remediation action.
- Automation levels are configured within the Microsoft 365 Defender portal for AIR.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
AIR automation levels control how Microsoft 365 Defender responds to threats.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Review aIR automation levels control how Microsoft 365 Defender responds to threats., then practise related MS-102 questions on the same topic to reinforce the concept.
- →
Manage security and threats by using Microsoft Defender XDR — study guide chapter
Learn the concepts, then practise the questions
- →
Manage security and threats by using Microsoft Defender XDR practice questions
Targeted practice on this topic area only
- →
All MS-102 questions
975 questions across all exam domains
- →
Microsoft 365 Administrator MS-102 study guide
Full concept coverage aligned to exam objectives
- →
MS-102 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related MS-102 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Deploy and manage a Microsoft 365 tenant practice questions
Practise MS-102 questions linked to Deploy and manage a Microsoft 365 tenant.
Implement and manage Microsoft Entra identity and access practice questions
Practise MS-102 questions linked to Implement and manage Microsoft Entra identity and access.
Manage security and threats by using Microsoft Defender XDR practice questions
Practise MS-102 questions linked to Manage security and threats by using Microsoft Defender XDR.
Manage compliance by using Microsoft Purview practice questions
Practise MS-102 questions linked to Manage compliance by using Microsoft Purview.
Manage users, groups, licensing, and support practice questions
Practise MS-102 questions linked to Manage users, groups, licensing, and support.
Implement and manage identity and access in Microsoft Entra ID practice questions
Practise MS-102 questions linked to Implement and manage identity and access in Microsoft Entra ID.
MS-102 fundamentals practice questions
Practise MS-102 questions linked to MS-102 fundamentals.
MS-102 scenario practice questions
Practise MS-102 questions linked to MS-102 scenario.
MS-102 troubleshooting practice questions
Practise MS-102 questions linked to MS-102 troubleshooting.
Practice this exam
Start a free MS-102 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this MS-102 question test?
Manage security and threats by using Microsoft Defender XDR — This question tests Manage security and threats by using Microsoft Defender XDR — AIR automation levels control how Microsoft 365 Defender responds to threats..
What is the correct answer to this question?
The correct answer is: Set the automation level for device isolation to 'Full - remediate threats automatically' — Option B is correct because setting the automation level for device isolation to 'Full - remediate threats automatically' in Microsoft Defender for Endpoint's automated investigation and response (AIR) configuration allows the system to automatically isolate a device when a high-severity malware alert is triggered, without requiring analyst approval. This automation level is specifically designed to execute remediation actions like device isolation immediately based on the alert's severity and the device's risk level.
What should I do if I get this MS-102 question wrong?
Review aIR automation levels control how Microsoft 365 Defender responds to threats., then practise related MS-102 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
AIR automation levels control how Microsoft 365 Defender responds to threats.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security administrator wants to configure Automated Investigation and Response (AIR) in Microsoft 365 Defender to automatically isolate a device when a high-severity alert for malware is detected. Which step is required?
medium- A.A: Create an automation rule in Microsoft Sentinel.
- B.B: Create a custom detection rule in advanced hunting.
- ✓ C.C: Configure the device to be part of a device group and enable automation level.
- D.D: Enable auto-removal of malware from devices.
Why C: To enable Automated Investigation and Response (AIR) in Microsoft Defender for Endpoint, the device must be added to a device group, and the automation level for that group must be set to 'Full – remediate threats automatically' or a similar level. This configuration allows Defender to automatically isolate a device when a high-severity malware alert is triggered, as part of the built-in AIR playbooks.
Variation 2. A security administrator needs to configure an automated investigation and response (AIR) playbook in Microsoft 365 Defender that will automatically isolate a device whenever a high-severity alert from Microsoft Defender for Endpoint is generated. The playbook must run without requiring manual approval. Which configuration must the administrator set to achieve automatic device isolation?
hard- ✓ A.Set the automation level for device isolation to 'Full - automatically remediate threats' in the Advanced Features settings.
- B.Create a custom detection rule that triggers on high-severity alerts and uses an automated action.
- C.Configure the device isolation action to require approval in the automation level settings.
- D.Enable automatic remediation only for medium severity and above.
Why A: Option A is correct because the automation level for device isolation in Microsoft 365 Defender's Advanced Features settings controls whether the AIR playbook executes actions automatically. Setting it to 'Full - automatically remediate threats' ensures that when a high-severity alert triggers the playbook, device isolation is performed without requiring manual approval, meeting the requirement for fully automated response.
Variation 3. A security administrator needs to create an automated investigation and response (AIR) playbook that automatically isolates a device whenever a high-severity alert from Microsoft Defender for Endpoint is generated. The playbook should run without requiring manual approval. Which capability in Microsoft 365 Defender should the administrator configure?
hard- ✓ A.Automated investigation and response (AIR) action policy
- B.Custom detection rule
- C.Threat analytics
- D.Attack simulation training
Why A: Option A is correct because Automated Investigation and Response (AIR) action policies in Microsoft 365 Defender allow administrators to define automated remediation actions—such as device isolation—that execute automatically when specific alert conditions are met, without requiring manual approval. The policy can be configured to trigger on high-severity alerts from Microsoft Defender for Endpoint, enabling fully automated containment of compromised devices.
Last reviewed: Jun 11, 2026
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.