A file server used by a shared service account begins renaming documents, deleting shadow copies, and creating outbound SMB connections to many internal hosts. The SOC suspects the malware may be spreading while also encrypting data. Which two actions are the best immediate containment steps? Select two.

Restore the server from backup before taking any containment action.

Restoring too early can overwrite evidence and may reintroduce the malware if the restoration source is not verified. Backups matter, but containment comes first when the compromise is still active. The environment must be stabilized before recovery begins.

Delete the suspicious files from the server to stop the encryption process.

Manually deleting files is risky and can destroy evidence without reliably stopping the malware. If the process is still active, the attacker may continue through other paths or credentials. Removing files is not the preferred first containment step when the host is still communicating internally.

Inform users that the incident is likely a false positive and continue monitoring.

The observed behaviors are consistent with active malicious activity, not a harmless alert. Continuing to monitor without containment allows additional damage and possible spread. This would be an operationally unsafe response given the encryption, shadow-copy deletion, and internal SMB activity.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Isolate the affected server from the network through EDR or switch controls. — The best immediate containment steps are isolating the server and disabling the compromised service account. Isolation stops the encryption and blocks further network propagation from the affected host. Resetting the service account closes a likely path for lateral movement because the attacker appears to be using it to reach other systems. Those actions contain the incident without destroying evidence prematurely. Why others are wrong: Restoring from backup, deleting files, or dismissing the alert all risk worsening the incident. Recovery should wait until containment and evidence collection are complete, and manual cleanup can destroy crucial forensic artifacts. The priority is to cut off the infected server and the compromised credentials it may be using.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.