Your company wants to optimize using Microsoft Defender for Endpoint to protect its resources against ransomware based on Microsoft Security Best Practices. You need to prepare a post-breach response plan for compromised computers based on the Microsoft Detection and Response Team (DART) approach in Microsoft Security Best Practices. What should you include in the response plan?

A post-breach response plan for a compromised computer, especially in a ransomware scenario, must prioritize containment to prevent lateral movement. The Microsoft Detection and Response Team (DART) methodology emphasizes this containment phase. Machine isolation is a core response capability in Microsoft Defender for Endpoint designed for this purpose. It disconnects the compromised device from the network, effectively stopping the threat from spreading to other resources. The isolated machine maintains a connection only to the Defender for Endpoint service, allowing security teams to conduct investigations and remediation actions safely without risk of further network contamination. This is the most direct and effective immediate response action for a compromised endpoint.

A. controlled folder access: This is a preventative Attack Surface Reduction (ASR) control configured before an attack to protect specific folders, not a post-breach response action.
B. application isolation: This is less comprehensive than machine isolation. An attacker may have compromised the entire operating system, making application-level isolation insufficient for containment.
C. memory scanning: This is a detection method used by security tools to find threats, not a response or containment action taken after a compromise is confirmed.
E. user isolation: This action, such as disabling an account, is appropriate for a compromised identity, not for containing a threat on a compromised computer itself.

1. Microsoft Learn. "Take response actions on a device in Microsoft Defender for Endpoint." Under the section Isolate devices from the network, it states, "This action can help prevent the attacker from controlling the compromised device and performing other activities such as data exfiltration and lateral movement." This directly supports machine isolation as a primary post-breach response.

2. Microsoft Security Blog. "The Microsoft DART ransomware approach and best practices." In the article, under the Contain phase of the incident response lifecycle, a key recommended activity is to "Isolate compromised systems: Disconnect affected systems from the network to prevent further spread." This aligns the answer directly with the DART approach mentioned in the question.

3. Microsoft Learn. "SC-100: Design solutions for security operations." In the module covering incident response with Microsoft Sentinel and Microsoft Defender XDR, containment actions are a key topic. The documentation emphasizes using built-in tool capabilities, such as device isolation in Defender for Endpoint, to contain threats during an active incident.