SC-200 Practice Question 3805
Exam: SC-200
Domain: Respond to security incidents
Difficulty: hard
You need to restrict a compromised device in Defender for Endpoint so that it can only communicate with other systems if the connection is explicitly allowed via an app isolation sandbox. What action provides this?
Answer Options
A
App isolation (selective isolation mode)
B
Full device isolation with zero network traffic
C
Reformatting the hard drive array
D
BitLocker drive lock
Correct Answer
A: App isolation (selective isolation mode)
Explanation
App isolation (or Device isolation in selective mode) restricts network traffic while allowing specified IT troubleshooting tools (like Outlook or Teams) to remain functional.