SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Power the workstation off immediately and leave it in place

  Why it's wrong here

  Powering the workstation off immediately is a volatile-evidence-destroying action. It terminates the RAM contents that often hold indicators of compromise (IOCs) such as running malicious processes, open network sockets, and unencrypted encryption keys, while also severing the ability to capture live memory forensics. It also performs no isolation: the attack may already have moved laterally to other systems, and the sudden power loss can trigger anti-forensic routines or corrupt logs on the disk. Therefore, it is a poor first response because it sacrifices forensic insight without providing controlled containment.

• ✓

  Quarantine the workstation from the network using EDR or switch port containment

  Why this is correct

  This is the best immediate containment action because it stops further spread while preserving evidence. EDR quarantine or disabling the switch port isolates the infected host without unnecessarily powering it down. The SOC can then collect volatile and disk evidence, determine the scope of infection, and proceed with eradication and recovery steps in the proper incident response sequence.

• ✗

  Run a full antivirus scan while the workstation remains connected

  Why it's wrong here

  Running a full antivirus scan with the workstation still on the network fails to stop the active encryption or prevent lateral movement, so it is not a containment measure. The scan relies on signature definitions that may not yet recognize the ransomware variant, and while the scan runs, the malware can continue mapping and encrypting network shares or communicating with its C2 server. Additionally, the heavy I/O and file-access activity from the scan can overwrite unallocated space and degrade forensic artifacts, hindering later incident analysis. The correct priority is to isolate the host first, then use scanning only after containment as part of eradication.

• ✗

  Wipe and reimage the workstation from a standard build image

  Why it's wrong here

  Reimaging is an eradication/recovery step, not an initial response, and it permanently destroys all on-disk evidence needed to understand the incident. Wiping the drive removes the ransomware binary, log files, registry keys, and any clues about the initial access vector, making root cause analysis impossible. It also does nothing to contain the threat: if the ransomware has already spread through SMB or other mechanisms, the reimage leaves the rest of the network vulnerable, and the attacker could simply re-enter through a still-open backdoor. Proper incident response requires preserving evidence and isolating the host before any reimage decision is made.

Go deeper

Related to this question