SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Disconnect the server from the network to contain the spread.

  Why this is correct

  Immediately disconnecting the server from the network (unplugging the NIC, disabling the switch port, or isolating the VLAN) contains the active ransomware by stopping it from encrypting additional network shares, communicating with its command-and-control server, or moving laterally to other hosts. This network cutover is the first-priority containment action after active encryption is confirmed because it minimizes blast radius while preserving the machine's volatile memory and running processes for forensic triage. Unlike a hard shutdown, it keeps the host in a state where investigators can later image the disk and extract indicators of compromise.

• ✗

  Restore the file share from backup immediately while the server is still connected.

  Why it's wrong here

  Restoring the file share from backup while the server is still connected is counterproductive because the active encryptor is still running in memory and on disk, so it will likely re-encrypt the restored files almost immediately, or the restore job itself could be corrupted by the malware. This action also overwrites critical forensic evidence, such as NTFS timestamps, USN journal entries, and log files, making incident analysis and attribution nearly impossible. Restoring before containment can even spread encrypted or malicious files back into the backup infrastructure if the restore is pointed at the wrong share, so proper IR order requires isolating the host and capturing evidence before any recovery step.

• ✗

  Power off the server immediately without any other action.

  Why it's wrong here

  A hard power-off (pulling the plug or forcing shutdown) without first isolating the host destroys volatile forensic evidence, including memory-resident encryption keys, open network connections, and the ransomware process itself, which can hamper attribution and decryption efforts. Some ransomware variants use anti-forensic tricks to wipe data or corrupt the volume on an unclean shutdown, and a power-off does not actively contain the spread because other hosts may still be communicating with the same C2 server or holding encrypted files in memory. Controlled network isolation is less disruptive than a hard shutdown, preserves more forensic value, and should always precede authoritative shutdown decisions in an incident response.

• ✗

  Notify users to change their passwords before any technical action is taken.

  Why it's wrong here

  Asking users to change passwords before taking any technical action delays containment while the ransomware continues encrypting files and potentially exfiltrating sensitive data to an external server. Password resets do not stop an active encryption process that is already running with system or user privileges, and the malware may have already harvested credentials or created persistence mechanisms that would survive the password change. Credential rotation belongs in the eradication phase—after the host is isolated and the attacker's access has been severed—because performing it first wastes time and may even lock out legitimate recovery staff without protecting any assets.

Go deeper

Related to this question