SY0-701 Security Operations Practice Question
An employee reports a ransomware note on a finance laptop. The laptop is still powered on, connected to Wi-Fi, and the user says they were just working in a spreadsheet. Management wants the fastest safe response that also preserves evidence. What should the responder do first?
⚠ Common exam trap
The SY0-701 exam often tests the misconception that shutting down a compromised system is the safest immediate action, but the trap here is that volatile evidence is lost and the ransomware may have anti-forensic shutdown triggers, making network isolation the correct first step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the laptop from the network while keeping it powered on for volatile evidence collection.
The immediate priority is to contain the ransomware while preserving volatile evidence (e.g., memory contents, running processes, network connections) that could be critical for forensic analysis. Powering off the laptop (Option A) would destroy volatile data and may allow the ransomware to persist or trigger additional encryption on reboot. Isolating the network connection stops the ransomware from communicating with its command-and-control server or spreading laterally, while keeping the system powered on allows a responder to capture memory with tools like FTK Imager or LiME before performing a controlled shutdown.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shut the laptop down immediately to prevent further encryption activity.
Why it's wrong here
Powering off the laptop is a well-intentioned but catastrophic move for forensic preservation: it destroys all volatile data in RAM, including decryption keys, malicious process memory, and active network connection state. It also terminates any running malware before it can be analyzed, and may even trigger a ransomware self-destruct routine designed to erase its own artifacts. The encryption activity may have already completed, so shutting down offers no reliable containment benefit, but it does guarantee the loss of the most time-sensitive evidence. Always keep the system powered on and instead remove it from the network to stop further command-and-control communication.
- ✓
Isolate the laptop from the network while keeping it powered on for volatile evidence collection.
Why this is correct
The best first action is to contain the threat without destroying live evidence. Disconnecting network access limits further spread or command-and-control activity, while keeping the system powered on preserves memory, running processes, and other volatile artifacts that may be critical to the investigation. This balances containment with evidence preservation, which is exactly what responders need at the start of an incident.
- ✗
Ask the user to close all open applications and log off normally.
Why it's wrong here
Asking the user to close applications and log off normally is essentially an aborted forensic acquisition: the logout process forcibly terminates running processes, flushes memory caches, and may trigger user-profile teardown routines that overwrite or destroy crucial artifacts like running service credentials, open file handles, and the exact execution timeline. It also gives the ransomware a chance to complete any in-progress encryption or to invoke persistence mechanisms that survive reboot, all while losing the live process list and network connections that an investigator would need. Furthermore, the user's actions introduce uncontrolled changes to the system state, tainting the evidence chain. The proper response is to let the system remain in its current running state and isolate it at the network layer.
- ✗
Start deleting suspicious files to reduce the impact of the ransomware.
Why it's wrong here
Deleting suspicious files in response to a ransomware infection is a false sense of remediation: it does nothing to stop active encryption processes that are already running in memory, and it may actually accelerate destruction if the ransomware monitors for anti-forensic activity. It also destroys critical digital evidence—ransomware binaries, scripts, and dropped files—that could yield Bitcoin addresses, C2 infrastructure, or decryption clues, and it corrupts file system metadata like timestamps and journal entries that are vital for reconstructing the attack timeline. Since deletion does not contain the threat and can be actively harmful, the correct first step is network isolation, not file removal.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.