SY0-701 Security Operations Practice Question
An EDR alert flags suspicious PowerShell on a finance workstation. Windows logs show the script started immediately after a patch-management tool launched from the software distribution server. The script only queries installed software and writes results to a log file. What is the most likely conclusion?
⚠ Common exam trap
Candidates often assume any PowerShell execution is malicious, but the SY0-701 exam tests the ability to correlate process ancestry and script behavior to distinguish legitimate administrative activity from actual threats.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The alert is likely a false positive because the activity matches approved patch-management behavior
The EDR alert is likely a false positive because the PowerShell script's behavior—querying installed software and writing results to a log file—is consistent with legitimate patch-management inventory tasks. The script's execution immediately after the patch-management tool launched from the software distribution server indicates it was triggered by that tool as part of its normal operations, not by an attacker. Since the activity matches approved patch-management behavior and shows no signs of malicious intent (e.g., data exfiltration, lateral movement, or persistence), the alert should be investigated but is most likely a false positive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The alert is likely a false positive because the activity matches approved patch-management behavior
Why this is correct
This alert is best classified as a false positive because the detected PowerShell activity aligns with a known, approved patch-management workflow. In enterprise environments, patch-management platforms routinely execute PowerShell scripts on endpoints to inventory software, check patch status, and install updates, often in coordination with the local distribution server. The existence of a matching policy or change-control record, combined with the script's behavior and the trusted source (the distribution server), strongly indicates legitimate administrative activity rather than malicious code execution. EDR alerts must be correlated with environmental context and known-good baselines before escalating to an incident.
- ✗
The workstation is definitely compromised because PowerShell is always malicious
Why it's wrong here
Although PowerShell is a favorite tool for attackers because it enables fileless execution and direct memory access, it is equally essential for legitimate system administration, automation, and configuration management. Countless enterprise scripts run PowerShell daily to query WMI, modify registry settings, deploy software, and perform health checks. The mere presence of PowerShell on a workstation cannot prove compromise; security teams must inspect the script's content, its parent process, the invoking user, and the endpoint's behavior around the execution time to distinguish benign administration from genuine malicious activity. Jumping to 'definitely compromised' is a common bias that leads to unnecessary and costly incident response actions.
- ✗
The endpoint should be immediately wiped because the script wrote to a log file
Why it's wrong here
Writing to a log file is a routine operation for countless legitimate scripts, including patching tools, monitoring agents, and scheduled maintenance tasks. A script that logs its own activity is usually a sign of well-written administrative code, not an indicator of compromise. Wiping (reimaging) an endpoint is a disruptive, last-resort action reserved for confirmed infections with significant impact; doing so solely because a script wrote to a log would ignore the broader context—such as the script's source, signature, and alignment with change management documentation—and could destroy valuable forensic data that might otherwise confirm or clear the alert.
- ✗
The software distribution server should be blocked from the network permanently
Why it's wrong here
The software distribution server is almost certainly the originating system for the approved patch-management script, so permanently blocking it from the network would sever a critical administrative channel and break routine operations for many endpoints. Rather than blocking, the proper response is to verify the server's integrity, confirm that the script matches the approved change request, and query the EDR for any other anomalous behavior from that server. Permanent network blocking is a disproportionate and potentially self-inflicted denial-of-service action that would harm the organization's security posture and operational stability more than the benign PowerShell activity it was meant to stop.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
EDR alert
An EDR alert is a notification generated by Endpoint Detection and Response software when it detects potentially malicious activity or an anomaly on a device like a laptop, server, or workstation.
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.