SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  EDR remote isolation capability on the endpoint.

  Why this is correct

  Endpoint Detection and Response (EDR) agents run on the endpoint and can execute a remote isolation command that quarantines the host from the network while preserving volatile data such as memory, running processes, and open files for forensic analysis. This containment action stops lateral movement and further malicious activity within the enterprise, but it does not analyze the attachment's behavior beforehand. It is an appropriate post-detection response to a confirmed or strongly suspected malicious attachment on that specific machine.

• ✓

  Sandboxing the attachment before release to users.

  Why this is correct

  Sandboxing the attachment before releasing it to users is a preventive control that detonates the file in an isolated virtual environment, typically a VM or container, where its execution is monitored for suspicious behaviors such as registry modifications, file system changes, network callbacks, or process injection. The results are used to block the attachment from delivery or to alert analysts, without risking the production network. This directly addresses the question of whether the attachment is malicious and is the correct choice for proactively handling an unknown email attachment.

• ✗

  DLP monitoring to prevent accidental data leakage.

  Why it's wrong here

  Data Loss Prevention (DLP) solutions are designed to detect and prevent the unauthorized movement of sensitive data, such as credit card numbers or intellectual property, across email, web, and storage channels. A DLP system does not execute or inspect file attachments for malicious code; it only applies content-matching rules to data in motion or at rest, so it cannot determine whether the attachment is a malware payload. While DLP might trigger on a file containing sensitive data, it would not identify a suspicious attachment's malicious behavior, making it the wrong tool for this analysis.

• ✗

  A WAF filtering web requests to the application.

  Why it's wrong here

  A Web Application Firewall (WAF) is placed in front of web applications and filters HTTP/HTTPS requests to block common attacks like SQL injection, cross-site scripting, and parameter tampering. It is protocol-specific to web traffic and does not inspect email messages or attachment file structures, nor does it have visibility into endpoint file systems. Since the suspicious attachment arrives via SMTP and is stored on a mail server or user device, a WAF's filtering of web requests is unrelated to analyzing the file's content for malware.

• ✗

  Port mirroring on a switch for traffic review.

  Why it's wrong here

  Port mirroring, also known as SPAN, configures a switch to forward copies of traffic from one or more ports to a monitoring port where a packet capture or IDS can analyze the network flows. This is a passive security monitoring technique that provides visibility into network traffic but does not actively detonate or execute files; it only observes packets on the wire. Even if the attachment were transferred over the network, port mirroring would not be able to safely execute and analyze its behavior, as that requires a sandbox or an EDR agent on the endpoint.

Go deeper

Related to this question