The correct first step in ransomware incident response is to isolate the affected server from the network while keeping it powered on. This preserves volatile evidence such as memory contents, running processes, and active network connections, which are critical for forensic analysis to determine the ransomware’s entry vector and scope of compromise. Powering off the server would destroy this data, and restoring from backup prematurely risks reintroducing the infection or missing clues needed to prevent recurrence. On the Security+ SY0-701 exam, this scenario tests your understanding of the incident response process, specifically the “Identification” and “Containment” phases, and the common trap is assuming that immediate power-off or backup restoration is the fastest path to recovery. Remember the mnemonic “I.P.O.” — Isolate, Preserve, Observe — to recall that isolation comes first, not power-off.
SY0-701 Security Operations Practice Question
This SY0-701 practice question tests your understanding of security operations. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An employee reports a ransomware note on a file server. The server is still powered on, shares are still being accessed, and management wants service restored as quickly as possible. What should the incident response team do first?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the server from the network while keeping it powered on
The correct first step is to isolate the server from the network while keeping it powered on. This preserves volatile evidence (e.g., memory, running processes, network connections) that is critical for forensic analysis and understanding the ransomware's entry vector. Powering off would destroy this data, and restoring from backup prematurely could reintroduce the infection or miss evidence needed to prevent recurrence.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Power off the server immediately to stop all attacker activity
Why it's wrong here
Immediate shutdown may destroy volatile evidence and can complicate later investigation and recovery steps.
✓
Isolate the server from the network while keeping it powered on
Why this is correct
Isolation contains spread and preserves volatile data, which supports both recovery decisions and investigation.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Start restoring from backup before collecting any logs or memory data
Why it's wrong here
Restoring too early can overwrite evidence and make it harder to determine the original attack path.
✗
Delete the ransomware note and suspicious files to reduce business disruption
Why it's wrong here
Removing artifacts first destroys evidence and does not reliably stop the attacker or prevent recurrence.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume immediate power-off is the safest containment action, but CompTIA emphasizes preserving volatile evidence first, as powering off destroys critical forensic data that may be needed for decryption or attribution.
Detailed technical explanation
How to think about this question
Isolation can be achieved by disabling the network interface (e.g., `ifconfig eth0 down` on Linux or disabling the adapter in Windows) or by blocking the server's MAC address at the switch port (e.g., using `shutdown` on a Cisco switch port). This preserves the server's state for memory acquisition (e.g., using FTK Imager or LiME) and log collection (e.g., Windows Event Logs, Sysmon logs) without allowing the ransomware to communicate with its C2 server or spread laterally.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A SOC analyst notices unusual lateral movement in the network at 2 AM. The IR playbook dictates: identify and contain (isolate the affected machine), then eradicate (remove the malware), then recover (restore from backup), then document. Skipping containment before eradication risks the attacker regaining access. Questions like this test the sequence and rationale of incident response phases.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
Security Operations — This question tests Security Operations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Isolate the server from the network while keeping it powered on — The correct first step is to isolate the server from the network while keeping it powered on. This preserves volatile evidence (e.g., memory, running processes, network connections) that is critical for forensic analysis and understanding the ransomware's entry vector. Powering off would destroy this data, and restoring from backup prematurely could reintroduce the infection or miss evidence needed to prevent recurrence.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An employee reports a ransomware note on a finance laptop. The laptop is still powered on, connected to Wi-Fi, and the user says they were just working in a spreadsheet. Management wants the fastest safe response that also preserves evidence. What should the responder do first?
medium
A.Shut the laptop down immediately to prevent further encryption activity.
✓ B.Isolate the laptop from the network while keeping it powered on for volatile evidence collection.
C.Ask the user to close all open applications and log off normally.
D.Start deleting suspicious files to reduce the impact of the ransomware.
Why B: Option B is correct because the immediate priority is to contain the ransomware while preserving volatile evidence (e.g., memory contents, running processes, network connections) that could be critical for forensic analysis. Powering off the laptop (Option A) would destroy volatile data and may allow the ransomware to persist or trigger additional encryption on reboot. Isolating the network connection stops the ransomware from communicating with its command-and-control server or spreading laterally, while keeping the system powered on allows a responder to capture memory with tools like FTK Imager or LiME before performing a controlled shutdown.
Variation 2. A user reports that their laptop is suddenly encrypting files and showing a ransom note. What should the incident response team do first?
easy
A.Immediately restore the laptop from backup before collecting any information.
✓ B.Isolate the laptop from the network to limit spread and preserve evidence.
C.Return the laptop to the user and monitor for additional alerts.
D.Apply all pending software updates to the laptop while it remains online.
Why B: When a laptop suddenly encrypts files and displays a ransom note, it indicates an active ransomware infection. The incident response team's first priority is to isolate the laptop from the network to prevent the ransomware from spreading laterally to other systems and to preserve volatile evidence (e.g., memory contents, running processes) that could be lost if the system is powered off or reconnected. This aligns with the NIST SP 800-61 incident response guidelines, which emphasize containment before eradication or recovery.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.