Perform response actions on devices in Microsoft Defender for Endpoint, including live response and automatic attack disruption.

A security analyst is responding to an alert on an onboarded Windows device in Microsoft Defender for Endpoint. The analyst needs to interactively connect to the live device to inspect running processes, browse the file system, and stop a suspicious process by hand while the device stays online for the user. Which Microsoft Defender for Endpoint response action gives the analyst this hands-on remote session?

• ARun the antivirus scan action on the device so that Microsoft Defender Antivirus performs a full scan and remediates any malware it detects on the running endpoint.
• BIsolate the device from the network so that the analyst can keep the threat contained while reviewing the alert timeline and entity details from the device page.
• CRestrict app execution on the device so that only files signed by Microsoft are allowed to run, preventing the suspicious process from launching again during the investigation.
• DInitiate a live response session to the device, which opens a remote command shell for interactively browsing the file system, listing running processes, and stopping a process while the device remains online.check_circle Correct

Why A is wrong: An antivirus scan triggers an automated Defender Antivirus sweep of the endpoint, which is useful for cleaning known malware, but it runs unattended and gives the analyst no interactive shell to browse files or stop a chosen process by hand.

Why B is wrong: Device isolation cuts the endpoint off from the network to stop lateral movement, but it is a containment control; it does not open a remote command session, so the analyst still cannot manually inspect processes or files on the device.

Why C is wrong: Restrict app execution applies a code-integrity policy that blocks unsigned applications, which can stop a process relaunching, but it is a policy control with no interactive console for browsing the device or running ad-hoc commands.

Why D is correct: Live response is the Microsoft Defender for Endpoint feature that opens an interactive remote shell to an onboarded device, letting the analyst run commands to inspect processes and files and stop a process by hand without taking the endpoint offline.