SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Shut down the laptop immediately to stop any further activity.

  Why it's wrong here

  Powering off the finance laptop is an improper containment action because it severs volatile data: RAM holds the ransomware process, encryption keys, and a partial mapping of affected files. An abrupt power-off also destroys network connection state and can trigger encryption artifacts that make forensic recovery harder. Isolation via EDR preserves the endpoint's running state and memory, allowing investigators to gather evidence while containing the outbreak.

• ✓

  Use EDR to isolate the laptop from the network.

  Why this is correct

  EDR-based isolation is the correct first move because it enforces a logical network quarantine at the host, blocking outbound SMB, RDP, and other propagation paths while keeping the system powered on. This preserves volatile memory for acquisition, prevents the malware from completing encryption over mapped drives, and allows the incident responder to collect IOCs and determine scope without alerting the attacker. EDR isolation is reversible and granular, so it is preferred over physical disconnection.

• ✗

  Run a full antivirus scan before making any network changes.

  Why it's wrong here

  Running an antivirus scan first extends the window in which the ransomware can continue encrypting local files and hopping to nearby systems via network shares. AV signatures may be useless against a novel polymorphic ransomware binary, and the scan itself can modify file timestamps, alter malicious processes' state, and miss memory-resident components. Proper sequence is contain first via EDR isolation, then perform triage and analysis; scanning after containment addresses host intrusion without risking further spread.

• ✗

  Reimage the laptop right away from a standard corporate image.

  Why it's wrong here

  Reimaging the affected laptop immediately is premature because it destroys all forensic evidence—including the ransomware sample, encryption artifacts, and system logs—that could pinpoint the initial infection vector. Without containing and collecting evidence first, you cannot determine whether other endpoints or the finance share are already affected, and a wipe may let the attacker persist via other compromised credentials or backdoors. Incident response requires containment, evidence preservation, and scope analysis prior to eradication and system recovery.

Go deeper

Related to this question