An employee reports a ransomware note on a file server. The server is still powered on, shares are still being accessed, and management wants service restored as quickly as possible. What should the incident response team do first?

Power off the server immediately to stop all attacker activity

Immediate shutdown may destroy volatile evidence and can complicate later investigation and recovery steps.

Start restoring from backup before collecting any logs or memory data

Restoring too early can overwrite evidence and make it harder to determine the original attack path.

Delete the ransomware note and suspicious files to reduce business disruption

Removing artifacts first destroys evidence and does not reliably stop the attacker or prevent recurrence.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Isolate the server from the network while keeping it powered on — The best first step is to isolate the server from the network while leaving it powered on. That contains the incident and prevents further encryption, lateral movement, or data exfiltration, while still preserving volatile evidence such as memory state, active connections, and running processes. In incident response, containment should come quickly, but not in a way that destroys information needed for investigation and recovery. Why others are wrong: Powering off immediately can prevent further damage, but it may also destroy volatile data that investigators need. Restoring from backup is a recovery action, not the first containment step, and doing it too soon risks overwriting evidence. Deleting the note or suspicious files may reduce clutter, but it destroys artifacts and does nothing to properly contain the incident.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.