SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Shut down the laptop immediately and leave it on the desk.

  Why it's wrong here

  Shutting down the laptop may temporarily stop new files from being encrypted, but it does not safely contain an active infection. Ransomware operates in process memory where encryption keys, network connections, and the malicious binary are volatile; a hard power-off destroys that evidence and may allow the malware to trigger an abrupt shutdown that complicates triage. The correct first step for a live system is to isolate it from the network while keeping it powered on, so responders can preserve memory and image the host before any remediation.

• ✓

  Disconnect the laptop from the network to contain the infection.

  Why this is correct

  Disconnecting the laptop from the network deprives the ransomware of both lateral movement and command-and-control communication. Without network access, it cannot propagate via SMB/Windows Admin Shares, reach mapped drives, or download additional payloads/ransomware variants, while the live system stays intact for volatile memory collection. Physically unplugging the Ethernet cable or disabling Wi-Fi in the OS is a practical containment step that should be done before any reboot or cleanup.

• ✗

  Delete the ransom note and continue working until the next reboot.

  Why it's wrong here

  Deleting the ransom note is cosmetic because the active ransomware process stays resident in memory and will keep encrypting new or altered files, deleting Volume Shadow Copies, and attempting to spread. Continuing regular use creates additional victim files and gives the malware more opportunities to encrypt local profiles and any reconnected network shares, while also altering timestamps and other forensic artifacts. The only reason to leave the note is to preserve evidence; work on the machine must stop immediately.

• ✗

  Install a new browser extension to block the attacker.

  Why it's wrong here

  Installing a browser extension cannot stop ransomware because the malware is a standalone native process executing at the operating system level, not a malicious script in the browser context. An extension runs inside a sandboxed browser process and lacks the privileges to terminate a system-level crypto process, quarantine files, or restore encrypted data. Moreover, installing new software during an active incident requires network connectivity and introduces untrusted code, which may impede forensic analysis and worsen the compromise.

Go deeper

Related to this question