SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Disconnect the database server from the network.

  Why this is correct

  Disconnecting the database server from the network is the immediate containment step because it severs the active data transfer channel at the network interface, halting further exfiltration while leaving the operating system, running processes, and volatile memory intact. This preservation is vital for forensic acquisition of memory-resident indicators, encryption keys, and live command-and-control sessions. It also avoids the risk of file corruption from a forced shutdown, allowing investigators to recover logs and database state cleanly.

• ✗

  Shut down the database server.

  Why it's wrong here

  Shutting down the database server destroys volatile evidence—such as active network connections, in-memory malware processes, and unencrypted session keys—that resides in RAM and would be lost when power is cut. A graceful shutdown may invoke system cleanup tasks that alter logs, while an abrupt power-off can corrupt database files that have not been flushed to disk. It also needlessly disrupts availability because the server could be isolated first; forensic best practice is to capture memory before any shutdown.

  When this WOULD be correct

  If the question stated that the server is already isolated and the goal is to prevent further damage from a ransomware attack that encrypts data, shutting down could halt encryption and preserve encrypted files for recovery.

• ✗

  Implement network segmentation to isolate the server.

  Why it's wrong here

  Network segmentation is a strategic, time-consuming control that involves redesigning traffic flows, updating firewall rules, or reconfiguring VLANs, and it cannot be executed quickly enough to stop data that is already leaving the server this second. Even after microsegmentation is implemented, an attacker operating from a compromised internal account or application context may still have legitimate access paths that are hard to block without breaking business functionality. Segmentation is appropriate for prevention or post-incident hardening, not for containing an active, ongoing exfiltration event.

• ✗

  Block the IP address of the suspected attacker.

  Why it's wrong here

  Blocking the attacker's IP address is a superficial mitigation because it only stops traffic to a single destination address; the exfiltration process can switch to another IP, proxy, or anonymity network almost instantly, and the infected server continues to send data to whatever new endpoint the attacker controls. It also fails to address the root cause—the compromised account or service on the database server—which remains active and can embed persistence or cause further damage. Moreover, it alters network behavior and can tip off the attacker, while providing no forensic preservation of the server's runtime state.

  When this WOULD be correct

  This would be correct in a scenario where the attack is from a single, static external IP and the goal is to quickly stop a brute-force login attempt on a web application, without affecting internal services or needing to preserve network connections for forensics.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”