The correct answer is the "Isolate device" action in the Microsoft Defender for Endpoint AIR playbook. This action supports selective isolation, which uses the Windows Filtering Platform (WFP) to block all inbound and outbound traffic except to a predefined list of trusted IP addresses, allowing essential services like patching or compliance checks to continue. On the SC-200 exam, this concept tests your understanding of how automated investigation and response (AIR) can balance containment with operational continuity—a common trap is confusing full isolation with selective isolation, where the latter explicitly permits trusted IPs. Remember the memory tip: "Selective isolation keeps the patch pipeline open while slamming the door on threats."
SC-200 Mitigate threats using Microsoft Defender XDR Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft defender xdr. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization uses Microsoft 365 Defender. During an incident, the analyst wants to automatically isolate a compromised device from the network while allowing communication with a specific list of trusted IP addresses (e.g., for patching). Which action in an automated investigation and response (AIR) playbook for endpoints can achieve this?
Why wrong: This scans for malware but does not isolate the device from the network.
B
Isolate device
Correct: Isolation can be configured with an allowed list of IPs, such as update servers, while blocking all other traffic.
C
Contain device
Why wrong: Containment restricts the device's ability to communicate with other devices but does not support a custom list of allowed IPs like full isolation.
D
Restrict app execution
Why wrong: This allows only a set of applications to run but does not control network connectivity.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate device
The 'Isolate device' action in Microsoft Defender for Endpoint's automated investigation and response (AIR) playbook can be configured to isolate a device from the network while allowing communication with a specified list of trusted IP addresses (e.g., for patching or compliance). This is achieved through the 'selective isolation' capability, which uses Windows Filtering Platform (WFP) to block all inbound/outbound traffic except to the defined IPs. Option B is correct because it directly matches the requirement to maintain connectivity to trusted endpoints during isolation.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Run antivirus scan
Why it's wrong here
This scans for malware but does not isolate the device from the network.
✓
Isolate device
Why this is correct
Correct: Isolation can be configured with an allowed list of IPs, such as update servers, while blocking all other traffic.
Related concept
Read the scenario before looking for a memorised answer.
✗
Contain device
Why it's wrong here
Containment restricts the device's ability to communicate with other devices but does not support a custom list of allowed IPs like full isolation.
✗
Restrict app execution
Why it's wrong here
This allows only a set of applications to run but does not control network connectivity.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse 'Contain device' (which only blocks inbound connections from other devices) with 'Isolate device' (which blocks both inbound and outbound traffic, with optional selective allow lists), leading them to choose the wrong option when the question specifies allowing outbound communication to trusted IPs.
Detailed technical explanation
How to think about this question
Selective isolation works by applying Windows Filtering Platform (WFP) filters that block all network traffic except for connections to IP addresses explicitly added to the allow list. The isolation state is enforced by the Microsoft Defender for Endpoint sensor, which communicates with the cloud service to apply the policy. In a real-world scenario, an administrator might add the IPs of a WSUS server or a vulnerability management tool to the trusted list, ensuring the device can still receive critical patches while being isolated from the rest of the network.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Mitigate threats using Microsoft Defender XDR — This question tests Mitigate threats using Microsoft Defender XDR — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Isolate device — The 'Isolate device' action in Microsoft Defender for Endpoint's automated investigation and response (AIR) playbook can be configured to isolate a device from the network while allowing communication with a specified list of trusted IP addresses (e.g., for patching or compliance). This is achieved through the 'selective isolation' capability, which uses Windows Filtering Platform (WFP) to block all inbound/outbound traffic except to the defined IPs. Option B is correct because it directly matches the requirement to maintain connectivity to trusted endpoints during isolation.
What should I do if I get this SC-200 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is investigating an incident in Microsoft 365 Defender where a device is detected as infected with a trojan. The analyst wants to use automated investigation to contain the threat. Which action can be automatically taken on the affected device as part of a standard AIR playbook for endpoint detection and response?
easy
A.Remove the user account from the device.
B.Execute a full antivirus scan on the device.
C.Disable the network adapter.
✓ D.Initiate a device isolation.
Why D: In Microsoft Defender for Endpoint, the Automated Investigation and Response (AIR) playbook for endpoint detection and response includes the ability to isolate a device from the network. This action stops the device from communicating with other devices or the internet, containing the threat while allowing the investigation to continue. Option D is correct because device isolation is a standard containment action in the AIR playbook for trojan infections.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.