SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Disconnect the server from the network at the switch level.

  Why this is correct

  Isolating the server at the switch port is the proper containment step because it severs the network path used for data exfiltration without disrupting the host's power or volatile memory. This preserves running processes, open network connections, and other live forensic evidence, aligning with the NIST incident response framework's containment phase. It immediately halts the unauthorized data transfer while allowing the analyst to gather evidence from the live system.

• ✗

  Run a comprehensive antivirus scan on the server.

  Why it's wrong here

  A comprehensive antivirus scan is a detection and eradication activity, not a containment measure. During the scan, the server remains connected to the network, so the data exfiltration continues unabated, and the scan's intensive I/O activity may trigger malware countermeasures that destroy volatile evidence. Prioritizing the scan over containment delays the critical action of stopping the breach and may alert the attacker, worsening the incident.

  When this WOULD be correct

  This would be correct if the question described a suspected malware infection on a non-critical system with no signs of active data exfiltration, and the incident response procedure required initial triage with antivirus before any network isolation.

• ✗

  Notify the Chief Information Security Officer (CISO) of the incident.

  Why it's wrong here

  Notifying the CISO is a required step in incident response, but it does not stop the active data exfiltration. The immediate priority per NIST is containment to minimize the impact of the incident; every moment spent on reporting before isolating the server allows the attacker to transfer more sensitive financial data. Notification should occur concurrently with or immediately after the containment action, not as a substitute for isolating the server at the switch level.

  When this WOULD be correct

  This would be correct as the immediate next step if the incident response procedure requires notification of the CISO before any containment actions, or if the analyst lacks authority to disconnect and must escalate first.

• ✗

  Power off the server to prevent further damage.

  Why it's wrong here

  Powering off the server would prevent further file-level damage, but it is an overly aggressive action that sacrifices volatile forensic data. Memory contents, active network connections, running malicious processes, and unencrypted data in RAM are all lost on shutdown, severely hampering the investigation. In a financial incident, you should use logical network isolation at the switch first to contain the threat while preserving the system state, unless there is an immediate physical safety hazard.

  When this WOULD be correct

  In a scenario where a server is experiencing a destructive malware infection (e.g., ransomware encrypting files) and there is no need for forensic preservation, powering off can prevent further damage. For example, if a server is rapidly deleting critical data and network isolation is insufficient, power-off may be warranted.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question