SC-200 Respond to security incidents Practice Question
Exhibit
Refer to the exhibit.
```json
{
"value": [
{
"id": "12345",
"machineName": "PC-001",
"isolationStatus": "Isolated",
"isolationState": "Isolated",
"healthStatus": "Healthy"
}
]
}
```The exhibit shows the output of a Microsoft Defender for Endpoint API call to get machine information. What does the isolationStatus value indicate?
⚠ Common exam trap
A common mix-up: candidates confuse isolationStatus with device health or scanning status, assuming 'isolated' means the device is being scanned or is in a healthy state, rather than recognizing it as a specific network containment state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The device has been isolated from the network.
The isolationStatus value in Microsoft Defender for Endpoint indicates whether a device has been isolated from the network. When the value is 'Isolated', it means the device is blocked from communicating with other devices or the internet, typically as a response to a security incident. Option D is correct because this status directly reflects that the device is isolated from the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The device is healthy and has no issues.
Why it's wrong here
The device is healthy and has no issues. This is incorrect because the IsolationStatus field in the Defender for Endpoint output reports network containment state, not the overall security posture or health assessment. A device can be completely healthy yet isolated as a precaution, or compromised while still showing 'Not isolated' if no containment action has been taken. Thus, this option conflates a specific network action with a general health evaluation.
- ✗
The device is currently being scanned for malware.
Why it's wrong here
The device is currently being scanned for malware. This is misleading because a malware scan is an on-demand or scheduled remediation activity, whereas isolation is a network restriction measure designed to sever a device's communication with the rest of the environment. The 'Isolated' status indicates that an admin or automated response action has contained the device, not that any scanning process is running. Therefore, observing an isolation state gives no indication whether a scan is in progress; these are independent capabilities of the platform.
- ✗
The device is not isolated and is fully connected.
Why it's wrong here
The device is not isolated and is fully connected. This option is the exact opposite of what the output shows. The displayed 'IsolationStatus' value is 'Isolated', meaning the device has been intentionally cut off from the corporate network, blocking all inbound and outbound traffic except limited communication with Defender for Endpoint cloud services. A fully connected device would have a status of 'NotIsolated' or possibly 'PendingIsolation' if a disconnect action is still being applied.
- ✓
The device has been isolated from the network.
Why this is correct
The device has been isolated from the network. This correctly interprets the 'IsolationStatus' value of 'Isolated'. Isolation is a containment action that severs the device's network connectivity to prevent an active threat from communicating with command-and-control servers or moving laterally to other hosts. The only traffic usually allowed while isolated is limited communication with the Defender for Endpoint service, allowing admins to monitor or reverse the isolation if needed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.