SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Shut down the VM immediately to stop all malicious activity.

  Why it's wrong here

  Shutting down the VM halts malicious activity but also terminates the runtime state, erasing volatile evidence such as memory-resident malware, active network connections, and in-memory encryption keys from the /proc and /sys filesystems. It also imposes immediate downtime on a revenue-generating Linux host, which violates the incident response principle of balancing containment with business continuity. Network-layer isolation should be used instead to stop further harm while preserving the live system for forensic acquisition.

• ✓

  Isolate the VM at the network layer while keeping it powered on.

  Why this is correct

  Isolating the VM at the network layer—for example, by applying a firewall ACL, moving the virtual NIC to a quarantine VLAN, or using vNIC-level security groups—denies the attacker further command-and-control and lateral movement while leaving the operating system, processes, and memory intact for live acquisition. This approach minimizes disruption to a critical revenue system, is reversible, and gives the SOC time to collect volatile evidence like open sockets and process lists from a Linux environment. It is the preferred initial containment action because it cuts off attacker communication without destroying the forensic state.

• ✗

  Wait for the next maintenance window before taking action.

  Why it's wrong here

  Delaying containment until a scheduled maintenance window allows the active compromise to continue, enabling ongoing data exfiltration, credential harvesting, and potentially the deployment of ransomware or backdoors. In an incident response timeline, minutes matter; waiting for a convenient window violates the requirement to contain with 'speed and precision' as stated in NIST SP 800-61, and significantly increases the blast radius and recovery cost. Containment actions should be taken immediately once a critical VM is confirmed compromised, not put on a business calendar.

• ✗

  Reimage the VM from a known-good template immediately.

  Why it's wrong here

  Reimaging the VM from a known-good template is a recovery step, not a containment step, because it destroys all on-disk artifacts, including malware binaries, logs, persistence mechanisms, and attacker-created accounts. It also wipes the filesystem before forensic duplication, losing critical indicators of compromise and potentially allowing the same attack vector to be re-exploited if the root cause is never discovered. The correct order is to isolate the instance, preserve evidence, then, only after investigation, consider reimaging if warranted by the business and technical impact.

Go deeper

Related to this question