A workstation opens an attachment labeled as an invoice and then begins creating scheduled tasks, disabling security services, and contacting a known malicious IP address. What is the best first containment action?

Run a full antivirus scan while leaving the system connected

A scan is useful later, but leaving the host online allows the malware to continue communicating and spreading.

Reboot the workstation to clear any active malicious processes

A reboot can destroy volatile evidence and may not remove persistence mechanisms such as scheduled tasks.

Uninstall the email client that delivered the attachment

Removing the email client does not contain the active infection already running on the endpoint.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Isolate the workstation from the network using the EDR containment feature — The best first step is to isolate the workstation from the network using an EDR containment feature. That action immediately limits command-and-control communication, prevents lateral movement, and reduces the chance of additional damage while the team preserves evidence for analysis. After isolation, responders can collect volatile data, determine persistence methods, and decide whether reimaging or cleanup is appropriate. Why others are wrong: Scanning alone is too slow and leaves the compromise active. Rebooting may wipe volatile evidence and does not reliably remove persistence. Uninstalling the email client does nothing to stop malware already executing on the host. Containment comes before remediation in an incident response workflow.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.