AB-650 Practice Question 3143
Exam: AB-650
Domain: Govern and secure Microsoft 365 tenants and workloads
Difficulty: medium
You need to isolate a malware-infected Windows workstation from the local network while still allowing the security team to run remote commands via Microsoft Defender. Which action should you execute?
Answer Options
A
Execute the "Isolate device" response action
B
Delete the device object from Microsoft Entra ID
C
Disable the local network switch port physically
D
Perform a BitLocker cryptographic hard drive erase
Correct Answer
A: Execute the "Isolate device" response action
Explanation
The "Isolate device" action in Defender for Endpoint cuts off all IP connectivity except for communication with the Defender cloud management plane.