SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Disable the software updater immediately to prevent further registry modifications.

  Why it's wrong here

  Disabling the software updater is a reactive action that alters the host's baseline and halts legitimate patching, potentially leaving the system more vulnerable to known exploits. More importantly, the alert might indicate that the updater is being abused as a living-off-the-land binary to write registry keys for persistence or privilege escalation, so killing the process or disabling the service does not remove the attacker's foothold. The analyst must first determine whether the registry modifications align with the update's expected behavior or show signs of malicious injection, such as unusual child processes or memory modifications, before taking any disruptive action.

  When this WOULD be correct

  This would be correct if the EDR alert indicated that the process was unsigned, had a suspicious file path, or was known malware, and the analyst had confirmed malicious activity requiring immediate containment.

• ✗

  Create an exception rule in the EDR to suppress future alerts for this process.

  Why it's wrong here

  Creating an exception rule in the EDR suppresses alerts based on indicators like the process path or name, but an attacker who has compromised the updater can easily operate under that trusted identity. Without investigating the memory state, command-line arguments, and parent-child process relationships, you risk blinding the SOC to process hollowing or DLL injection that initiated the alert. Suppressing the alert is a 'trust but verify' violation and a dangerous shortcut that converts a potential security event into a permanent blind spot, which is why the first step is thorough analysis, not suppression.

• ✓

  Investigate the user's recent activity and check for signs of process hollowing or DLL injection.

  Why this is correct

  This is the correct next step. The analyst should examine the process's behavior in depth, including checking for anomalies such as unexpected command-line arguments, suspicious parent processes, or indicators of code injection, before concluding whether the alert is a false positive.

• ✗

  Isolate the workstation from the network and reimage the system immediately.

  Why it's wrong here

  Isolation and reimaging are containment and eradication measures that are only appropriate after triage confirms a compromise; acting on an unconfirmed alert is premature and highly disruptive to the user and the business. Reimaging destroys volatile evidence like memory-resident malware, injected DLLs, or artifacts of the attack chain that are crucial for understanding the threat actor's tactics and preventing future incidents. Furthermore, isolating the host stops live monitoring and forensics at the moment you need the most data, so the correct first step is to investigate user activity, process behavior, and memory for indicators of process hollowing or DLL injection before deciding on extreme measures.

  When this WOULD be correct

  This would be correct if the EDR alert indicated a known malicious process (e.g., ransomware) modifying the Run key, and the analyst had confirmed the file hash matched a known threat, requiring immediate containment.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question