AB-650 Practice Question 3143
Exam: AB-650
Domain: Govern and secure Microsoft 365 tenants and workloads
Difficulty: medium
You need to isolate a malware-infected Windows workstation from the local network while still allowing the security team to run remote commands via Microsoft Defender. Which action should you execute?
Answer Options
A
Execute the ""Isolate device"" response action
B
Delete the device object from Microsoft Entra ID
C
Disable the local network switch port physically
D
Perform a BitLocker cryptographic hard drive erase
Correct Answer
A: Execute the ""Isolate device"" response action
Explanation
The ""Isolate device"" action in Defender for Endpoint cuts off all IP connectivity except for communication with the Defender cloud management plane.