Exam SC-200 topic 7 question 14 discussion

When an identity is contained, any supported Microsoft Defender for Endpoint onboarded device will block incoming traffic in specific protocols related to attacks (network logons, RPC, SMB, RDP), terminate ongoing remote sessions and logoff existing RDP connections (terminating the session itself including all its related processes), while enabling legitimate traffic. https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#contain-user-from-the-network

When Automatic Attack Disruption in Microsoft Defender XDR contains a user due to an identified attack, it takes specific actions to isolate the user and prevent the spread of the attack. One of these actions is blocking specific protocols to limit lateral movement and access to other devices. For User1, attempting to connect to another device (Device2) after being contained will result in blocking access via the following protocols: RDP (Remote Desktop Protocol): Commonly used for remote management and often exploited in lateral movement attacks. RPC (Remote Procedure Call): Used for remote execution of tasks and communication between Windows systems; also a common target for attackers. SMB (Server Message Block): Facilitates file sharing and other operations between devices. Attackers frequently exploit SMB vulnerabilities for lateral movement and data exfiltration.

Not sure but from Copilot: F