Question 1,574 of 1,038
SC-200 Respond to security incidents Practice Question
A security analyst needs to contain a compromised device that is spreading malware in the network. The device is enrolled in Microsoft Intune and managed by Microsoft Defender for Endpoint. What is the fastest way to isolate the device from the network?
⚠ Common exam trap
It's easy for candidates to confuse device isolation with account blocking or device wipe, not realizing that isolation is a network-level containment action that preserves the device's ability to communicate with the security management plane.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Microsoft Defender for Endpoint to initiate device isolation.
Microsoft Defender for Endpoint provides a dedicated 'Device isolation' action that immediately blocks all network traffic to and from the device while maintaining connectivity to the Defender service for management and monitoring. This is the fastest containment method as it can be triggered directly from the Defender portal without requiring additional configuration or user interaction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the device in Microsoft Intune.
Why it's wrong here
Disabling in Intune prevents management, but the device can still communicate on the network.
- ✓
Use Microsoft Defender for Endpoint to initiate device isolation.
Why this is correct
Device isolation blocks all network traffic except communication with Defender for Endpoint cloud services.
- ✗
Perform a remote wipe of the device from Microsoft Intune.
Why it's wrong here
Wiping is destructive and slower, and may not be necessary if isolation is sufficient.
- ✗
Block the user's account in Microsoft Entra ID.
Why it's wrong here
Blocking the user does not isolate the device itself.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.