SY0-701 Security Operations Practice Question
An EDR alert shows suspicious PowerShell activity on a remote employee laptop, and the user is still logged in to cloud applications. Which two response actions are best if the device is believed to be actively compromised? Select two.
⚠ Common exam trap
Many candidates confuse 'stopping the activity' with 'powering off the device,' failing to recognize that volatile data collection must precede any shutdown to preserve forensic evidence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the endpoint through the EDR tool or quarantine its network access.
Isolating the endpoint via the EDR tool or quarantining its network access immediately stops the attacker's ability to communicate with command-and-control servers, preventing lateral movement and further data exfiltration. This containment action is a critical first step in incident response for an actively compromised device, as it preserves the integrity of the investigation while halting malicious activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the endpoint through the EDR tool or quarantine its network access.
Why this is correct
Network isolation is the fastest way to stop additional attacker communication, lateral movement, and command execution from the compromised laptop. It contains the incident while preserving the system state for investigation. EDR quarantine is particularly useful for remote devices because it can be applied without physical access to the endpoint.
- ✓
Collect a live response package or volatile data before cleanup begins.
Why this is correct
Live response data can reveal running processes, network sessions, loaded modules, and persistence mechanisms that would otherwise disappear. In a suspected compromise, that information is vital for understanding scope and root cause. Collecting it before cleanup preserves evidence and supports later eradication and recovery steps.
- ✗
Power off the laptop immediately to stop the activity as fast as possible.
Why it's wrong here
Powering off can destroy volatile evidence and may not be necessary if EDR isolation is available. Although shutdown stops the local process, it also removes the chance to collect useful live-state artifacts. The safer approach is to contain first and capture evidence before full remediation.
- ✗
Wait until the user returns the laptop to the office for physical inspection.
Why it's wrong here
Delaying response leaves the compromised system active and connected for too long. Remote containment is specifically designed to avoid that delay. Waiting also gives the attacker more time to move laterally or abuse the user’s cloud sessions.
- ✗
Remove the EDR agent so the attacker cannot detect the investigation.
Why it's wrong here
Removing the EDR agent eliminates a core defensive control and may give the attacker more freedom to operate. It also reduces visibility during the incident. The endpoint should be contained and monitored, not stripped of protective tooling.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
EDR
Endpoint Detection and Response (EDR) is a cybersecurity technology that continuously monitors endpoint devices to detect, investigate, and respond to advanced threats.
Key term
EDR alert
An EDR alert is a notification generated by Endpoint Detection and Response software when it detects potentially malicious activity or an anomaly on a device like a laptop, server, or workstation.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.