The correct answer is Device isolation.

Device isolation in Microsoft 365 Defender lets an administrator cut off a compromised workstation from the network while preserving local access for investigation. It blocks inbound and outbound network traffic from the device and prevents lateral movement to other systems so that the incident cannot spread.

Using Device isolation is the direct containment action to take when a host is exhibiting unusual outbound traffic and unfamiliar processes. This action immediately limits the host network connectivity and helps protect other systems while you investigate and remediate.

Threat intelligence provides contextual information about threats and indicators and it helps analysts understand what is happening, but it does not itself disconnect a device from the network. It is useful for detection and investigation but not for immediate containment.

Automated response refers to automated investigations and remediation workflows and it may include containment actions, but it is a broader capability rather than the specific action that severs network access. The exam asks for the specific containment feature which is device isolation.

Network segmentation is an architectural network control that limits traffic between zones and reduces blast radius, but it is not a Microsoft 365 Defender action you trigger to immediately isolate a single compromised workstation. It is a preventative design rather than an on-demand containment action.

Full AWS Practitioner Certification Question