- A
Capture volatile data such as running processes and active network connections while the system is still live.
Volatile data disappears on shutdown, so collecting it first protects the most transient evidence. Running processes and live connections can reveal malware, remote-control tools, or current attacker activity. This is especially important when the device is still powered on and reachable through EDR.
- B
Place the endpoint into network isolation through the EDR console to stop further attacker communication.
Isolation limits further spread, exfiltration, and remote tampering without requiring immediate power loss. Because the host is still online, EDR isolation is a controlled way to contain the threat while preserving the possibility of collecting evidence first. It is a more measured choice than yanking power or rebooting.
- C
Run a full antivirus scan immediately, because the scan report will serve as the primary evidence.
Why wrong: A full scan can change files, trigger malware behavior, and overwrite useful artifacts. It is not the best first action when the priority is preserving volatile evidence and containing the endpoint. Scan results also do not replace live data capture.
- D
Reboot the laptop into Safe Mode so the attacker’s code will not load.
Why wrong: Rebooting destroys volatile evidence and may trigger malicious cleanup or encryption behavior. Safe Mode can be useful later for remediation, but it is not appropriate before collecting live data from a suspected compromised system.
- E
Power off the laptop immediately to prevent the incident from spreading further.
Why wrong: Immediate power-off prevents any further live collection and can destroy evidence that exists only in memory or active sessions. While it may stop some malicious activity, it is too blunt for the stated requirement to preserve evidence first.
SY0-701 Security Operations Practice Question
This SY0-701 practice question tests your understanding of security operations. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A Windows laptop is believed to be involved in a credential-theft incident. It is still powered on, connected to Wi-Fi, and the user reports that the screen recently locked by itself. The SOC can reach the device remotely through EDR. Which two actions should be taken before the laptop is shut down? Select two.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Capture volatile data such as running processes and active network connections while the system is still live.
Option A is correct because capturing volatile data (e.g., running processes, active network connections, memory contents) is a critical first step in forensic response. This data resides in RAM and is lost when the system is powered off, so it must be collected while the laptop is still live to preserve evidence of the attacker's current activities, such as active credential theft tools or command-and-control connections.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Capture volatile data such as running processes and active network connections while the system is still live.
Why this is correct
Volatile data disappears on shutdown, so collecting it first protects the most transient evidence. Running processes and live connections can reveal malware, remote-control tools, or current attacker activity. This is especially important when the device is still powered on and reachable through EDR.
Related concept
Read the scenario before looking for a memorised answer.
- ✓
Place the endpoint into network isolation through the EDR console to stop further attacker communication.
Why this is correct
Isolation limits further spread, exfiltration, and remote tampering without requiring immediate power loss. Because the host is still online, EDR isolation is a controlled way to contain the threat while preserving the possibility of collecting evidence first. It is a more measured choice than yanking power or rebooting.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Run a full antivirus scan immediately, because the scan report will serve as the primary evidence.
Why it's wrong here
A full scan can change files, trigger malware behavior, and overwrite useful artifacts. It is not the best first action when the priority is preserving volatile evidence and containing the endpoint. Scan results also do not replace live data capture.
- ✗
Reboot the laptop into Safe Mode so the attacker’s code will not load.
Why it's wrong here
Rebooting destroys volatile evidence and may trigger malicious cleanup or encryption behavior. Safe Mode can be useful later for remediation, but it is not appropriate before collecting live data from a suspected compromised system.
- ✗
Power off the laptop immediately to prevent the incident from spreading further.
Why it's wrong here
Immediate power-off prevents any further live collection and can destroy evidence that exists only in memory or active sessions. While it may stop some malicious activity, it is too blunt for the stated requirement to preserve evidence first.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often choose to immediately power off or run an antivirus scan, mistakenly believing these actions contain the incident, when in fact they destroy critical volatile evidence and violate forensic best practices.
Detailed technical explanation
How to think about this question
Volatile data collection typically involves using tools like `netstat -anob` for network connections, `tasklist /v` for processes, and dumping RAM with tools like FTK Imager or WinPmem. In a real-world incident, the attacker may have a reverse shell or keylogger running in memory; capturing this data before isolation or shutdown can reveal the attacker's IP, used ports, and the specific credential-stealing payload. Network isolation via EDR (e.g., Microsoft Defender for Endpoint's 'Isolate device' feature) blocks all inbound/outbound traffic except to the EDR service, preventing the attacker from exfiltrating data or issuing new commands while preserving the system state for forensic analysis.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Security Operations — study guide chapter
Learn the concepts, then practise the questions
- →
Security Operations practice questions
Targeted practice on this topic area only
- →
All SY0-701 questions
1,152 questions across all exam domains
- →
Security+ SY0-701 study guide
Full concept coverage aligned to exam objectives
- →
SY0-701 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SY0-701 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
General Security Concepts practice questions
Practise SY0-701 questions linked to General Security Concepts.
Threats, Vulnerabilities, and Mitigations practice questions
Practise SY0-701 questions linked to Threats, Vulnerabilities, and Mitigations.
Security Architecture practice questions
Practise SY0-701 questions linked to Security Architecture.
Security Operations practice questions
Practise SY0-701 questions linked to Security Operations.
Security Program Management and Oversight practice questions
Practise SY0-701 questions linked to Security Program Management and Oversight.
Security+ social engineering questions
Practise SY0-701 questions linked to Security+ social engineering questions.
Security+ cryptography practice questions
Practise SY0-701 questions linked to Security+ cryptography.
Security+ IAM questions
Practise SY0-701 questions linked to Security+ IAM questions.
Security+ risk management questions
Practise SY0-701 questions linked to Security+ risk management questions.
Security+ incident response questions
Practise SY0-701 questions linked to Security+ incident response questions.
Security+ malware questions
Practise SY0-701 questions linked to Security+ malware questions.
Security+ vulnerability management questions
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practice this exam
Start a free SY0-701 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SY0-701 question test?
Security Operations — This question tests Security Operations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Capture volatile data such as running processes and active network connections while the system is still live. — Option A is correct because capturing volatile data (e.g., running processes, active network connections, memory contents) is a critical first step in forensic response. This data resides in RAM and is lost when the system is powered off, so it must be collected while the laptop is still live to preserve evidence of the attacker's current activities, such as active credential theft tools or command-and-control connections.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.