Responding to Compromised Linux Endpoints in Microsoft Defender XDR

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender XDR

Short answer

C Use the Isolate device action to prevent the compromised Linux endpoint from communicating with other devices onboarded to Defender for Endpoint.

Question

You have a Microsoft 365 subscription. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint.
You have 500 devices that run Linux.
Users sign in to the Windows and Linux devices by using their Microsoft Entra credentials.
You need to recommend a response process for Microsoft Defender XDR security incidents associated with a compromised Linux endpoint. The solution must ensure that the compromised device is prevented from communicating with all devices onboarded to Defender for Endpoint.
Which response action should you include in the recommendation?
  1. Contain user
  2. Contain device
  3. Isolate device Correct Answer
  4. Confirm user compromised

Key Takeaways

The main trap is selecting 'Contain device' which is not a specific action, or doubting if Linux devices can be isolated. The key insight is that 'Isolate device' is the supported action for both Windows and Linux to cut off network communication.

Learn how to respond to security incidents involving compromised Linux endpoints in Microsoft Defender XDR by using the Isolate device action to block network communication.

Common mistake: Choosing 'Contain device' because it seems like a logical containment step, or choosing 'Contain user' because the user credentials were compromised, missing the requirement to stop device-to-device communication.

Expert Analysis

The question requires a response action that prevents a compromised Linux device from communicating with other devices onboarded to Defender for Endpoint. The key constraint is the operating system: Linux.

Option B, "Contain device," is not a standard, standalone response action in Microsoft Defender XDR's incident response playbook. The primary containment actions are "Isolate device" and "Contain user." Therefore, options A and D are incorrect because they target the user identity rather than the network connectivity of the specific endpoint, which does not satisfy the requirement to stop communication between devices. Option C, "Isolate device," is the correct technical mechanism. Microsoft Defender for Endpoint supports isolating devices (including Linux) from the network, preventing them from communicating with other endpoints while maintaining a management connection to the security center.

Why "Contain device" sounds right but is wrong: Some candidates might argue that "containment" is a broader concept or that isolation is too aggressive. However, in the context of the exam's available actions, "Isolate device" is the precise command used to achieve network isolation. The comment suggesting "Contain device" exists is likely confusing the general phase of incident response with the specific button/action in the UI. Another common trap is assuming Linux cannot be isolated; however, as noted in community discussions, Microsoft has added support for device isolation on Linux devices running Defender for Endpoint. Since the prompt implies these are managed devices (or at least capable of being managed via Entra ID), and isolation is supported on Linux, C is the only valid technical action that meets the goal.

Official Reference

https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#isolate-devices-from-the-network

This link opens the official vendor documentation in a new tab.

Exam Strategy

When dealing with incident response questions, always match the required outcome (e.g., 'prevent communication') to the specific available action in the console. Remember that 'Isolate device' applies to both Windows and Linux when Defender is installed, whereas 'Contain user' affects identity-based access, not direct device networking.

Frequently Asked Questions

Can I isolate a Linux device in Microsoft Defender for Endpoint?

Yes, Microsoft Defender for Endpoint supports isolating Linux devices from the network. This allows you to contain threats while maintaining a management connection.

What is the difference between 'Contain user' and 'Isolate device'?

'Contain user' blocks the user's ability to sign in or access resources based on their identity. 'Isolate device' blocks the specific machine's network traffic, preventing it from communicating with other endpoints or servers.

More SC-200 FAQ →

Community Votes

B
50%
C
50%

50% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. kasutakun 👍 3 Answered C
    https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/announcing-device-isolation-support-for-linux/3676400
  2. indope94 👍 3 Answered B
    B. Isolate doesnt work on linux.
  3. GeoSoc 👍 2 Answered B
    There are two hints here I believe. "The subscription contains 500 Windows 11 devices" "You have 500 devices that run Linux." It says nowhere that Linux devices are onboarded. And also, "prevented from communicating" points to "Contain device".
  4. milkfish 👍 1
    Are you sure? "Isolating devices from the network is supported when Defender is running in passive mode on all supported Windows operating systems, macOS and Linux supported versions." Ref: https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#isolate-devices-from-the-network
  5. titwa 👍 1 Answered B
    The question is: the compromised device is prevented from COMMUNICATING with all devices onboarded to Defender for Endpoint. So containing is enough, isolating is overkill.
Show 3 more comments
  1. jorgs4 👍 1 Answered C
    Option B doesn't make sense in defending XDR, since that option doesn't exist in the available actions, therefore the only option is C Insolate Device
  2. cbdfbaf 👍 1
    I agree with B because the question does not state that Linux devices are onboarded. You cant insolate a device that's not onboarded
  3. bvargasa 👍 1 Answered C
    C looks ok as per MS documentation

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide