Your company wants to optimize using Microsoft Defender for Endpoint to protect its resources against ransomware based on Microsoft Security Best Practices. You need to prepare a post-breach…

Question

Options

• Acontrolled folder access
• Bapplication isolation
• Cmemory scanning
• Dmachine isolation
• Euser isolation

• A
  15% (7)
• B
  2% (1)
• C
  7% (3)
• D
  74% (34)
• E
  2% (1)

Explanation

The Microsoft Detection and Response Team (DART) post-breach playbook for ransomware prioritizes machine isolation as the immediate response action for compromised computers. Isolating the machine cuts off its network connectivity to prevent the ransomware from spreading laterally to other systems, communicating with command-and-control (C2) infrastructure, or encrypting additional network shares-all while preserving forensic evidence on the machine. Microsoft Defender for Endpoint provides a one-click 'Isolate device' action directly in the portal. Controlled folder access (A) is a preventive measure to protect folders from ransomware writes, not a post-breach containment action. Application isolation (B) and memory scanning (C) are not primary DART response steps. User isolation (E) involves revoking user credentials but does not stop an already-running ransomware process on a compromised machine.

No community discussion yet for this question.