SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A workstation opens an attachment labeled as an invoice and then begins creating scheduled tasks, disabling security services, and contacting a known malicious IP address. What is the best first containment action?
⚠ Common exam trap
Candidates often choose to run an antivirus scan or reboot first, thinking they can clean the infection, but the exam emphasizes that containment (stopping the spread and C2) is the immediate priority over remediation or removal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation from the network using the EDR containment feature
The workstation is actively communicating with a known malicious IP address and disabling security services, indicating an active compromise. Isolating the workstation via EDR containment immediately stops the outbound command-and-control traffic and prevents lateral movement, which is the priority first step in incident response before any remediation or analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a full antivirus scan while leaving the system connected
Why it's wrong here
Running a full antivirus scan while leaving the system connected is insufficient because the scan only identifies known signatures and does not terminate active malicious processes or block their network traffic. The infected endpoint remains able to communicate with its command-and-control server and pivot to other hosts, enabling the malware to propagate before the scan ever finishes. Modern ransomware and fileless malware can evade signature-based scans, making this a passive detection step, not a containment action.
- ✓
Isolate the workstation from the network using the EDR containment feature
Why this is correct
Isolating the workstation via EDR containment immediately terminates the attacker's ability to issue commands by applying a strict host firewall rule that blocks inbound and outbound traffic, except for the management plane needed to preserve remote visibility. This severs command-and-control channels and halts lateral movement while keeping the system powered on, allowing investigators to acquire volatile memory and collect forensic artifacts. EDR containment is the preferred first response because it balances swift containment with forensic preservation, unlike more disruptive measures.
- ✗
Reboot the workstation to clear any active malicious processes
Why it's wrong here
Rebooting the workstation clears memory-resident malware but does not address persistence mechanisms such as scheduled tasks, services, or registry run keys, which will simply reload the malware on the next boot. The reboot also destroys volatile evidence—active network connections, decrypted payloads, and injected code—that incident responders rely on to identify the attacker and scope the breach. Some advanced threats use fileless techniques that vanish upon reboot, so the system appears clean while the infection is actually reintroduced by a persistent remote administration tool.
- ✗
Uninstall the email client that delivered the attachment
Why it's wrong here
Uninstalling the email client does nothing to stop the payload that is already running in memory; the malicious executable has already left the email context and is live as a process on the endpoint. This action does not terminate the process, remove persistence entries, or sever the malware's network communications, and it may alter event logs and file timestamps that are critical for forensic analysis. It also wastes valuable time during the initial containment phase, when the priority is stopping further spread rather than removing the delivery vector.
Go deeper
Related to this question
Learn chapter
Threat Intelligence and Indicators of Compromise
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.