SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Capture RAM or a volatile memory image before the system is powered off

  Why this is correct

  RAM and other volatile memory hold a live snapshot of the compromise: running processes, loaded kernel modules, open sockets, active network sessions, decrypted payloads, and plaintext encryption keys often exist nowhere on disk. Once the workstation is powered off, this data vanishes instantaneously and cannot be recovered by any forensic technique, so a memory capture with a tool like WinPmem or FTK Imager must be acquired first. Malware frequently operates entirely in memory—fileless variants or injected code—making the RAM image the only source of evidence of their execution. This is the foundational step in the Order of Volatility and the first action to take during live response.

• ✓

  Record running processes, open network connections, and logged-on users

  Why this is correct

  Recording running processes, active network connections, and logged-on users preserves transient system state that a memory dump alone may not fully contextualize, such as the ownership of a malicious process or the remote IP pair of an active command-and-control session. These observations document live activity—like lateral movement or data exfiltration—that can be correlated with the memory image to reconstruct the attacker's actions minute by minute. On Windows, tools like PowerShell's Get-Process and Get-NetTCPConnection, or the built-in netstat/tasklist, capture this information even on systems lacking advanced forensics software. This step should occur immediately after memory capture, while the system is still trusted enough to run diagnostic commands.

• ✗

  Shut the workstation down immediately and restart it cleanly

  Why it's wrong here

  Shutting the workstation down and rebooting it cleanly is exactly what an incident responder must avoid, because power loss erases every volatile artifact—processes, network sockets, clipboard content, and kernel pools—that could identify the malware. On startup, persistent malware commonly triggers anti-forensic and self-destruct routines, and modern ransomware has been observed encrypting data or wiping traces upon detecting a reboot. Furthermore, a restart overwrites event logs and other forensic evidence with new boot-time entries, muddying the timeline and possibly setting off a destructive kill switch. The correct action is to perform a live response and capture RAM before any power cycling.

• ✗

  Run a disk defragmentation utility to prepare for imaging

  Why it's wrong here

  Running a defragmentation utility on a suspect drive modifies the physical layout of file data, rewrites the Master File Table, and updates numerous file system timestamps, thereby destroying proof of when and how files were written or deleted. It also overwrites 'slack space' and unallocated clusters that might contain remnants of the malware or deleted user files—data that disk-imaging tools could otherwise recover. In forensic practice, any write operation to original media violates the integrity chain; even launching a tool can alter access times, which is why investigators use hardware write-blockers or acquire a bit-for-bit image first. Defragmentation is thus an anti-forensic action that permanently compromises the evidentiary value of the drive.

• ✗

  Uninstall the suspected malware before collecting any evidence

  Why it's wrong here

  Uninstalling the suspected malware before collecting evidence actively destroys the very artifacts needed to establish how the malware executed, persisted, and spread. The uninstaller deletes executable files, registry run keys, scheduled tasks, and service entries, while also rewriting MFT records and altering numerous timestamps that would otherwise reveal the infection timeline. In incident response, the system must first be preserved through memory acquisition and forensically sound disk imaging; only then should remediation such as removal or reimaging occur. Removing malware first is a common and costly error that can leave the investigation without proof of compromise.

Go deeper

Related to this question