SY0-701 Security Operations Practice Question
After confirming malicious activity on a workstation, the incident lead wants the system cleaned up quickly. The analyst has not yet collected any volatile data. What should the analyst do before remediation begins?
⚠ Common exam trap
The trap here is that candidates may prioritize speed of remediation over proper forensic procedure, forgetting that volatile data is the most time-sensitive evidence and must be collected before any system changes occur.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture volatile evidence such as memory and running process information before changing the system.
Volatile data (e.g., memory contents, running processes, network connections) is lost when the system is powered off or changed. The analyst must capture this evidence first to preserve forensic artifacts that can identify the root cause, scope, and indicators of compromise (IOCs) before remediation alters the system state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Capture volatile evidence such as memory and running process information before changing the system.
Why this is correct
Volatile data disappears quickly and often contains the best clues about active malicious behavior, injected code, network connections, and open sessions. Capturing memory and process state before cleanup preserves that evidence for later analysis. Once remediation begins, many of those artifacts are lost or altered. In an incident response workflow, evidence collection should happen before eradication whenever the system is still available and safe to examine.
- ✗
Immediately uninstall every suspicious application and delete related files.
Why it's wrong here
Uninstalling applications and deleting files alters file system metadata, removes registry keys, deletes prefetch and shimcache artifacts, and can trigger kernel callbacks that overwrite evidence. It also destroys malware binaries and persistence mechanisms required for malware analysis and indicator-of-compromise development. Proper procedure is to preserve forensically sound copies and document system state before any remediation.
- ✗
Restore the workstation from backup before documenting the incident.
Why it's wrong here
Restoration rebuilds the filesystem, overwrites slack space and unallocated clusters, resets SAM hive and event logs, and destroys all residual data from the compromise. It also prevents correlation with network logs and adversary TTPs, hampering containment across the environment. Recovery should follow evidence collection and containment, not precede documentation.
- ✗
Close the incident because the malicious activity has already been confirmed.
Why it's wrong here
Confirmed malware presence triggers escalation and activation of the incident response plan, but without scoping, containment, eradication, and lessons learned, the incident remains open. Closing prematurely leaves C2 channels active, lateral movement undiscovered, and backdoors for reinfection. Incident closure requires verification of eradication and formal documentation of findings and recovery.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An EDR alert shows suspicious PowerShell activity on a remote employee laptop, and the user is still logged in to cloud applications. Which two response actions are best if the device is believed to be actively compromised? Select two.
medium- ✓ A.Isolate the endpoint through the EDR tool or quarantine its network access.
- ✓ B.Collect a live response package or volatile data before cleanup begins.
- C.Power off the laptop immediately to stop the activity as fast as possible.
- D.Wait until the user returns the laptop to the office for physical inspection.
- E.Remove the EDR agent so the attacker cannot detect the investigation.
Why A: Isolating the endpoint via the EDR tool or quarantining its network access immediately stops the attacker's ability to communicate with command-and-control servers, preventing lateral movement and further data exfiltration. This containment action is a critical first step in incident response for an actively compromised device, as it preserves the integrity of the investigation while halting malicious activity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.