SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Run a quick cleanup script and return the laptop to the user

  Why it's wrong here

  A quick cleanup script only removes visible artifacts, but rootkits often install kernel-mode drivers, hook system calls, or hide persistence points like services and scheduled tasks. Without a full wipe, you cannot guarantee the script eliminated every component, especially since the rootkit can actively evade an insecurely running scanner or reinfect from a dormant copy. Therefore, returning the laptop to the user leaves a potentially compromised system in production.

• ✓

  Disconnect the laptop, then reimage it from a known-good source

  Why this is correct

  Disconnecting the laptop isolates it from the network, stopping any ongoing command-and-control communication, data exfiltration, or lateral movement. Reimaging from a known-good source (after securely erasing the disk, and ideally verifying firmware integrity) removes not only the visible malware but also any kernel-level or boot-level persistence mechanisms. This is the only option that provides a trustworthy, verifiable baseline for returning the device to service.

• ✗

  Disable the user account and leave the device in place

  Why it's wrong here

  Disabling the user account is an access-control change that prevents logons, but it does nothing to halt malware that runs in kernel context or triggers during the boot process. Leaving the device in place—presumably still connected to the network—allows the rootkit to continue communicating, potentially spreading to other hosts or capturing new credentials. The device should be isolated and reimaged, not merely left with an account disabled.

• ✗

  Delete the suspected hidden files manually from Windows Explorer

  Why it's wrong here

  Windows Explorer relies on Win32 APIs that rootkits can hook to hide exactly the files, processes, and registry keys you need to find. Even if you delete some visible files manually, the rootkit may hold copies in alternate data streams, in unallocated disk space, or inside a loaded kernel driver that restores them. Manual deletion is unreliable, and any partial removal can leave the system in an unstable state while still not eliminating the threat.