Question 759 of 1,013
SY0-701 Security Operations Practice Question
An employee reports a ransomware note on a file server. The server is still powered on, shares are still being accessed, and management wants service restored as quickly as possible. What should the incident response team do first?
⚠ Common exam trap
Candidates often assume immediate power-off is the safest containment action, but CompTIA emphasizes preserving volatile evidence first, as powering off destroys critical forensic data that may be needed for decryption or attribution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the server from the network while keeping it powered on
The correct first step is to isolate the server from the network while keeping it powered on. This preserves volatile evidence (e.g., memory, running processes, network connections) that is critical for forensic analysis and understanding the ransomware's entry vector. Powering off would destroy this data, and restoring from backup prematurely could reintroduce the infection or miss evidence needed to prevent recurrence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Power off the server immediately to stop all attacker activity
Why it's wrong here
Immediate shutdown can destroy volatile evidence in RAM, such as running processes, active network connections, decryption keys, and other attacker artifacts that are essential for forensic analysis. Abruptly cutting power may also cause file system corruption and can trigger anti-forensic behaviors, while doing nothing to eliminate other persistence mechanisms on the network. Moreover, a graceful shutdown process itself may be intercepted by malware to delete logs, so it does not reliably stop attacker activity.
- ✓
Isolate the server from the network while keeping it powered on
Why this is correct
Network isolation, such as unplugging the cable or applying a host-based firewall rule, halts the ransomware's ability to encrypt additional shares and disrupts command-and-control channels, effectively containing the blast radius. Keeping the server powered preserves memory-resident data, including the malicious process, open handles, and potential encryption keys, which can be harvested via a memory dump for attribution and recovery. This approach balances incident containment with evidence preservation, and should be executed in a way that doesn't delete or alter on-disk artifacts.
- ✗
Start restoring from backup before collecting any logs or memory data
Why it's wrong here
Restoring from backup before collecting logs and memory data will overwrite the compromised server's disk, erasing critical evidence such as event logs, registry keys, and malware artifacts needed to identify the initial access vector. Even if the backup itself is clean, the underlying vulnerability or credential compromise remains unknown, leaving a high risk of re-infection immediately after recovery. A proper forensic image and memory capture should precede any restoration to ensure the full attack path is understood and remediated.
- ✗
Delete the ransomware note and suspicious files to reduce business disruption
Why it's wrong here
Deleting the ransomware note and suspicious files eliminates key indicators of compromise, including the attacker's demands, wallet addresses, and any embedded IOCs that could help with threat intelligence or decryption. More importantly, file removal on a still-compromised system does not disrupt the attacker's active session or persistence mechanisms, so the infection can simply re-encrypt or spread further. The priority should be containment and evidence preservation, not cleaning artifacts before proper investigation.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An employee reports a ransomware note on a finance laptop. The laptop is still powered on, connected to Wi-Fi, and the user says they were just working in a spreadsheet. Management wants the fastest safe response that also preserves evidence. What should the responder do first?
medium- A.Shut the laptop down immediately to prevent further encryption activity.
- ✓ B.Isolate the laptop from the network while keeping it powered on for volatile evidence collection.
- C.Ask the user to close all open applications and log off normally.
- D.Start deleting suspicious files to reduce the impact of the ransomware.
Why B: The immediate priority is to contain the ransomware while preserving volatile evidence (e.g., memory contents, running processes, network connections) that could be critical for forensic analysis. Powering off the laptop (Option A) would destroy volatile data and may allow the ransomware to persist or trigger additional encryption on reboot. Isolating the network connection stops the ransomware from communicating with its command-and-control server or spreading laterally, while keeping the system powered on allows a responder to capture memory with tools like FTK Imager or LiME before performing a controlled shutdown.
Variation 2. A user reports that their laptop is suddenly encrypting files and showing a ransom note. What should the incident response team do first?
easy- A.Immediately restore the laptop from backup before collecting any information.
- ✓ B.Isolate the laptop from the network to limit spread and preserve evidence.
- C.Return the laptop to the user and monitor for additional alerts.
- D.Apply all pending software updates to the laptop while it remains online.
Why B: When a laptop suddenly encrypts files and displays a ransom note, it indicates an active ransomware infection. The incident response team's first priority is to isolate the laptop from the network to prevent the ransomware from spreading laterally to other systems and to preserve volatile evidence (e.g., memory contents, running processes) that could be lost if the system is powered off or reconnected. This aligns with the NIST SP 800-61 incident response guidelines, which emphasize containment before eradication or recovery.
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.