SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Isolate the endpoint using EDR network containment or a quarantine policy.

  Why this is correct

  EDR network containment or a quarantine policy is the appropriate first response because it immediately blocks network-level communication from the endpoint to any external C2 server or internal hosts, thereby preventing lateral movement while the endpoint remains in a forensically sound state. By keeping the process and disk intact, the SOC analyst can later extract memory dumps, review active network connections, and perform threat hunting without contaminating volatile evidence. This action aligns with the containment phase of incident response, prioritizing the preservation of evidence over immediate eradication.

• ✓

  Disable the user account and revoke active sessions or tokens for that identity.

  Why this is correct

  Disabling the user account and revoking active sessions or tokens is a critical identity-based containment step, especially if the EDR alert indicates the PowerShell process is running under a legitimate user context that could have been compromised. Revoking Kerberos tickets, OAuth access tokens, and any active session cookies prevents an attacker from reusing those credentials to authenticate from another device or to access cloud resources and email, even if the endpoint is already isolated. This action complements network isolation by stopping the attacker from leveraging stolen identity to move laterally via legitimate channels.

• ✗

  Reboot the workstation immediately to clear any malicious process from memory.

  Why it's wrong here

  Rebooting the workstation immediately is wrong because it destroys volatile memory, which often contains the malicious process code, injected artifacts, decrypted payloads, and active network connection state critical for understanding the intrusion. Moreover, many types of malware establish persistence through scheduled tasks, registry run keys, or services, so a reboot simply loads the malicious code again from disk, allowing the attacker to regain a foothold. Instead of clearing the infection, a reboot erases the very evidence needed for root-cause analysis while failing to disrupt persistence mechanisms.

• ✗

  Run a full vulnerability scan before taking any other action.

  Why it's wrong here

  Running a full vulnerability scan before taking any other action is inappropriate because it does nothing to halt an actively executing malicious PowerShell process or its network communications, and it delays the containment steps that would actually stop the attacker. Vulnerability scans are useful for identifying the initial attack vector, but they are slow, can be noisy, and might even be detected by the attacker as a signal that the SOC is responding. In incident response, the first priority must be containment—scanning should wait until the endpoint is isolated and evidence is preserved.

• ✗

  Delete the suspicious email from the mailbox to remove the original payload.

  Why it's wrong here

  Deleting the suspicious email from the mailbox fails to contain the threat because the PowerShell payload has already executed and resides in memory and possibly on the endpoint's disk, so removal of the original message does not stop the active process or prevent the attacker from continuing their actions. Moreover, the email is vital forensic evidence that documents the initial vector, attacker TTPs, and possibly indicators such as the sender address, URLs, and attachments—deleting it destroys that data and may violate evidence handling requirements. The correct action is to preserve the email as part of the investigation while containing the endpoint.

Go deeper

Related to this question