Incident responders are authorized to isolate a compromised pooled session host through Defender for Endpoint. Twelve users currently have sessions on that host. Which immediate impact must the responders account for?

✓ Correct answer

• All users on that host can lose network connectivity because isolation applies to the shared device.

Device isolation affects the shared host, not just one user's session or process. Plan containment and subsequent trusted replacement with awareness of every user's connectivity impact. Option explanations: A. Only the detected malicious process loses network access; other host sessions are unaffected.: Device isolation is not limited to the single malicious process. B. Isolation only hides the host in the Defender portal and changes no network behavior.: Isolation is a containment action, not merely an inventory-display change. C. All users on that host can lose network connectivity because isolation applies to the shared device.: This is the relevant pooled-host operational consequence. D. Azure Virtual Desktop automatically migrates all running processes to another host.: AVD does not automatically migrate running session process memory in response to endpoint isolation. Sources: Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations; Onboard non-persistent VDI devices to Microsoft Defender for Endpoint — https://learn.microsoft.com/en-us/defender-endpoint/configure-endpoints-vdi

Read the source reference