SC-200 Uses Microsoft 365 Defender Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Run antivirus scan

  Why it's wrong here

  Running an antivirus scan attempts to detect and remediate malware that is already present on the endpoint, but it does not alter the device's network connectivity or prevent the threat from spreading laterally to other systems. A scan is a reactive, file-system-focused action: it requires the device to remain online and does not block inbound or outbound traffic, so it cannot contain an active attack. In contrast, isolation breaks communication with the network, which is the necessary containment step.

• ✓

  Isolate device

  Why this is correct

  Isolate device is the correct response because it disconnects the compromised endpoint from the network while still permitting communication with specifically allowed IPs, such as Microsoft Defender for Endpoint services, Windows Update, or other approved update servers. This selectively quarantines the device at the network layer, blocking both inbound and outbound traffic to all other hosts, which stops lateral movement and data exfiltration. The ability to configure an allow list makes this action uniquely suited for maintaining critical services during an incident.

• ✗

  Contain device

  Why it's wrong here

  Contain device is not the right choice because containment is a more limited action that restricts the device's ability to communicate with other devices but does not offer the custom IP allow list that full isolation provides. In Microsoft 365 Defender, containment alone cannot preserve connectivity to essential services like update servers or the Defender backend, potentially causing the device to lose telemetry and remediation capabilities. Full isolation gives the security team granular control over what the isolated host can still reach, which is why it supersedes containment for this scenario.

• ✗

  Restrict app execution

  Why it's wrong here

  Restrict app execution is an application-control response that limits which executable files are allowed to run, typically to only those that are Microsoft-signed, but it has no direct effect on network connectivity. While this action can stop malicious binaries from launching, it does not prevent the compromised device from communicating with other systems, so the attack could continue to spread across the network. Because it does not address network-level compromise, it is insufficient as an incident containment measure.