SY0-701 Security Operations Practice Question
An EDR alert shows winword.exe launching powershell.exe with an encoded command after a user opened an invoice attachment. No new executable file was written to disk, and the host is still online. Which two actions should the SOC analyst take first to validate the alert and collect usable evidence? Select two.
⚠ Common exam trap
Many exam-takers think reimaging or deleting the email is a valid containment step, but the question specifically asks for actions to validate the alert and collect usable evidence, not to contain or remediate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the parent-child process chain and the full PowerShell command line in EDR.
Reviewing the parent-child process chain (winword.exe → powershell.exe) and the full PowerShell command line in the EDR allows the analyst to immediately validate whether the alert is a true positive by confirming the process lineage and decoding the encoded command. This step is critical for understanding the attacker's intent without relying on disk artifacts, as the attack is fileless and memory-resident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Review the parent-child process chain and the full PowerShell command line in EDR.
Why this is correct
Reviewing the parent-child process chain in EDR confirms that winword.exe actually spawned powershell.exe, validating the suspicious macro-to-PowerShell execution path rather than assuming a false positive. The full PowerShell command line is essential because it reveals whether an encoded payload, download cradle, or malicious script was passed, and it often exposes obfuscation techniques that would otherwise be invisible. This direct process and script evidence is the fastest and most reliable way to triage the alert before taking broader defensive action.
- ✗
Compare the endpoint's outbound connections with its normal baseline and approved destinations.
Why it's wrong here
Comparing outbound connections to a baseline can identify command-and-control traffic or data exfiltration, but it is a secondary step that does nothing to validate the immediate process-launch alert. Network traffic may remain absent if the PowerShell process was blocked or if no payload was fetched, so lack of anomalous connections would not clear the endpoint. This approach consumes time while the incident is still unconfirmed, whereas process tree and script analysis provide decisive evidence at the source.
- ✗
Reimage the workstation immediately to eliminate any possible persistence.
Why it's wrong here
Reimaging the workstation immediately is a containment/recovery action that presupposes the alert is a true positive and skips the validation phase entirely. Destroying the disk clears volatile artifacts like PowerShell script content, process memory, and prefetch files that could confirm the attack or trace the attacker's actions, leaving no forensic evidence. The incident should first be validated and scope understood; only then is reimaging an appropriate step.
- ✗
Ask the user to delete the suspicious email and clear the recycle bin.
Why it's wrong here
Asking the user to delete the suspicious email and clear the recycle bin is counterproductive because it alters or removes the original phishing artifact, a key piece of evidence, and user actions are unreliable and unverifiable. It does not confirm whether the macro actually executed or what PowerShell did, and the conversation history or attachment metadata could reveal the campaign's origin. The proper first step is to collect and preserve that evidence through EDR and forensic tools, not to delete it.
- ✓
Check PowerShell script block logs, AMSI detections, and related event records on the endpoint.
Why this is correct
Checking PowerShell script block logging, AMSI detections, and related event records on the endpoint provides deep visibility into what the PowerShell process actually executed, including deobfuscated script content that may not be visible in the command line alone. Script block logs record the full code blocks executed, while AMSI event IDs (e.g., Event ID 4104) can reveal whether a malicious payload was detected and blocked. This corroborates the process-chain evidence and determines whether the attack succeeded or was intercepted, making it an essential validation step.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
EDR alert
An EDR alert is a notification generated by Endpoint Detection and Response software when it detects potentially malicious activity or an anomaly on a device like a laptop, server, or workstation.
Key term
EDR
Endpoint Detection and Response (EDR) is a cybersecurity technology that continuously monitors endpoint devices to detect, investigate, and respond to advanced threats.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.