A SOC analyst receives an alert from the EDR system indicating that the process 'C:\Program Files\Vendor\Updater.exe' attempted to modify the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key on a user's workstation. The analyst checks the file hash and finds it matches a known legitimate software updater. Which of the following actions is most appropriate for the analyst to take?

Disable the software updater immediately to prevent further registry modifications.

Disabling the software updater might prevent future legitimate updates and does not address the possibility that the updater is being exploited. The analyst should first confirm whether the activity is malicious.

Create an exception rule in the EDR to suppress future alerts for this process.

Creating an exception without thorough investigation risks allowing an attacker to hide malicious activity behind a trusted process name. This is a common but dangerous shortcut.

Isolate the workstation from the network and reimage the system immediately.

Isolation and reimaging are extreme measures that should be reserved for confirmed compromises. Without evidence that the workstation is truly infected, this action would be premature and disruptive.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Investigate the user's recent activity and check for signs of process hollowing or DLL injection. — Legitimate processes can be abused by attackers using techniques such as process hollowing, DLL sideloading, or command-line injection. The analyst should not immediately assume the process is benign simply because the file hash matches a known good file. Further investigation, such as checking for suspicious parent-child process relationships, unusual command-line arguments, or signs of injection, is necessary to determine if the updater is being used maliciously. Creating an exception blindly could allow malicious activity to persist undetected, while disabling the updater may disrupt necessary software updates. Isolation and reimaging are too aggressive without confirmed compromise.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.