SC-200 Respond to security incidents Practice Question
A security analyst needs to contain a compromised device that is spreading malware in the network. The device is enrolled in Microsoft Intune and managed by Microsoft Defender for Endpoint. What is the fastest way to isolate the device from the network?
⚠ Common exam trap
It's easy for candidates to confuse device isolation with account blocking or device wipe, not realizing that isolation is a network-level containment action that preserves the device's ability to communicate with the security management plane.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Microsoft Defender for Endpoint to initiate device isolation.
Microsoft Defender for Endpoint provides a dedicated 'Device isolation' action that immediately blocks all network traffic to and from the device while maintaining connectivity to the Defender service for management and monitoring. This is the fastest containment method as it can be triggered directly from the Defender portal without requiring additional configuration or user interaction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the device in Microsoft Intune.
Why it's wrong here
Disabling the device in Microsoft Intune only revokes its MDM enrollment and stops policy synchronization, but it does not apply any network-level controls. The endpoint retains full network access, allowing it to continue communicating with internal systems, exfiltrate data, or propagate laterally. This action addresses manageability, not containment, so it is insufficient for isolating a compromised device.
- ✓
Use Microsoft Defender for Endpoint to initiate device isolation.
Why this is correct
Device isolation in Microsoft Defender for Endpoint is a response action that blocks all inbound and outbound network traffic on the endpoint, except for communication with Defender for Endpoint cloud services. It preserves the sensor's ability to send telemetry and receive additional commands while effectively cutting off lateral movement and data exfiltration. This is the intended containment mechanism for a compromised device during incident response.
- ✗
Perform a remote wipe of the device from Microsoft Intune.
Why it's wrong here
A remote wipe in Microsoft Intune is a destructive, irreversible action that erases corporate data and may reset the device to factory defaults. It requires the device to check in to the service and does not immediately block network communication—during the roll-out, the device can still cause harm. Additionally, wiping destroys forensic evidence, making it a poor choice when isolation alone can contain the threat.
- ✗
Block the user's account in Microsoft Entra ID.
Why it's wrong here
Blocking the user's account in Microsoft Entra ID prevents new authentication attempts but does not disrupt already established sessions or the device's network connectivity. A compromised device may operate using cached credentials, machine accounts, or existing tokens, and it can still communicate with other hosts on the network. This action targets the identity layer, not the endpoint itself, so it fails to contain the device's malicious activity.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.