A workstation suddenly begins making SMB connections to many internal servers within a few minutes. What is the best immediate response?

Allow the traffic because SMB is a normal file-sharing protocol.

SMB can be legitimate, but rapid connections to many hosts are not normal and may indicate lateral movement or compromise.

Delete the local event logs to reduce alert noise.

Deleting logs removes evidence and interferes with investigation. It does not stop the suspicious activity or protect other systems.

Disable all SMB services on every server immediately.

Turning off SMB everywhere is disruptive and too broad for initial containment. The suspicious endpoint should be contained first.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Isolate the workstation from the network for containment. — A workstation that rapidly contacts many internal systems over SMB is a common sign of lateral movement or worm-like behavior. The best immediate response is to isolate the workstation so it cannot continue scanning or accessing other hosts. Containment should focus on the suspected source first, then the team can determine whether the activity was malicious, misconfigured, or part of an authorized task. Why others are wrong: SMB being common does not make this pattern safe; the volume and spread are suspicious. Deleting logs destroys evidence and is never an appropriate first move. Disabling SMB globally is overly disruptive and does not address the likely infected source in a targeted way.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.