MS-102 Practice Question 3070
Exam: MS-102
Domain: Manage security and threats using Microsoft Defender XDR
Difficulty: medium
You need to isolate an endpoint compromised by active ransomware to prevent lateral movement, while maintaining connectivity between the machine and Microsoft Defender cloud management. Which action should you take?
Answer Options
A
Use the "Isolate device" response action
B
Delete the device object from Microsoft Entra ID
Correct Answer
A: Use the "Isolate device" response action
Explanation
The "Isolate device" response action cuts off network connectivity to and from the device except for communication with the Defender for Endpoint cloud service.