SC-100 Practice Question 3976
Exam: SC-100
Domain: Design security solutions for infrastructure
Difficulty: medium
You are designing endpoint isolation for compromised workstations in Defender for Endpoint. You want the security operations team to maintain Live Response command shell access while blocking all other outbound and inbound network traffic. What isolation mode should you use?
Answer Options
A
Full Isolation mode
B
Selective isolation mode with internet access allowed
C
Hard drive cryptographic erasure mode
D
Audit mode with zero network restrictions
Correct Answer
A: Full Isolation mode
Explanation
Full Isolation mode severs all network connectivity to the endpoint except for encrypted communication channels with the Microsoft Defender for Endpoint cloud relay.