SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A SIEM alert shows one workstation connecting to many internal systems over SMB in a short period of time, followed by attempts to access administrative shares. What is the best response?
⚠ Common exam trap
The trap here is that candidates may dismiss the alert as normal SMB traffic (Option A) because SMB is common, failing to recognize that the combination of rapid connections and administrative share access is a textbook lateral movement indicator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation to stop possible lateral movement
The SIEM alert describes classic indicators of lateral movement using SMB, often associated with ransomware or worm-like malware. Isolating the workstation immediately stops the attacker from spreading to other systems via administrative shares (e.g., ADMIN$, C$), which are commonly abused for remote execution. This containment step is the highest priority before any forensic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the alert because SMB is a normal file-sharing protocol
Why it's wrong here
Although SMB is a legitimate protocol for file sharing, a single workstation rapidly connecting to many internal hosts and repeatedly accessing administrative shares such as C$ or ADMIN$ is not normal baseline behavior. This pattern is strongly associated with worm-like propagation or lateral movement, especially when SMB is used to execute remote services via PsExec. Discounting the alert solely because SMB is common ignores the statistical and behavioral anomalies that triggered the SIEM threshold. The correct response is to treat this as a potential compromise indicator rather than benign file access.
- ✓
Isolate the workstation to stop possible lateral movement
Why this is correct
Isolating the workstation is the correct immediate response because the rapid SMB connections to multiple hosts indicate the attacker may be pivoting or spreading laterally. Removing the host from the network, either by disconnecting the cable or disabling the switch port, contains the blast radius while preserving volatile memory and network logs for forensic investigation. This aligns with NIST SP 800-61's containment phase, which prioritizes stopping propagation before eradication or recovery. Later steps can include blocking the account, patching the SMB service, and analyzing the observed behavior to identify the root cause.
- ✗
Increase the workstation's monitor brightness to help the user notice alerts
Why it's wrong here
Adjusting the monitor brightness is completely unrelated to the SIEM alert or the suspicious network activity; it neither prevents the workstation from initiating connections nor reduces risk. The alert is being processed by security analysts, not necessarily the user, so visual changes to the display have no effect on detection or response. This option is a distraction that fails to address the need for network-level containment and could waste valuable time during an active incident. Physical changes to the endpoint do not stop SMB scanning or lateral movement.
- ✗
Disable all SMB traffic across the entire company immediately
Why it's wrong here
Prohibiting all SMB traffic company-wide is an overly disruptive measure that would likely break legitimate file sharing, printing, and domain operations for hundreds of users, while the actual compromise may be limited to one host. Such a blanket action violates the principle of least privilege and proportional response, and it may even slow down incident response by harming business continuity. A better approach is to block SMB at the affected workstation or enforce segmentation only for that subnet, then confirm scope via SIEM and endpoint logs. Broadly disabling SMB before investigation can destroy evidence or trigger unintended zero-day disruptions.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
Key term
Worm
A worm is a type of malicious software that can copy itself and spread to other computers over a network, often without any human action.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.