SY0-701 Security Operations Practice Question
An EDR console alerts that powershell.exe launched with an encoded command on a finance workstation, and a minute later the host begins making repeated outbound connections to an unfamiliar IP address. What is the best initial response?
⚠ Common exam trap
A common mix-up: candidates confuse immediate containment (isolation) with eradication (antivirus scan) or evidence preservation (shutdown), but the SY0-701 emphasizes that isolation via EDR is the best initial response because it stops the threat without destroying volatile data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation through the EDR platform and preserve logs and volatile evidence for investigation.
Isolating the workstation via the EDR platform stops the immediate threat (the malicious outbound connections) while preserving volatile evidence (e.g., running processes, network connections, memory contents) and logs for forensic analysis. This aligns with the incident response principle of containment before eradication, and EDR isolation typically uses a host-based firewall rule to block all traffic except to the EDR management server, ensuring the host remains accessible for investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a full antivirus scan first and leave the workstation online so the user can keep working.
Why it's wrong here
Running a full antivirus scan is a reactive, signature-based step that does not halt the active encoded PowerShell process or its outbound beaconing; it may miss fileless or in-memory malware entirely. Leaving the workstation online lets the attacker maintain command-and-control, move laterally, or exfiltrate data while the scan churns. The scan itself alters system state and may alarm the adversary, corrupting forensic evidence and delaying containment.
- ✓
Isolate the workstation through the EDR platform and preserve logs and volatile evidence for investigation.
Why this is correct
Encoded PowerShell combined with outbound beaconing is a strong indicator of active malicious behavior. Isolating the endpoint through EDR contains the incident while preserving the host’s state for analysis. This approach is better than pulling the plug because it reduces attacker activity without unnecessarily destroying volatile evidence. The analyst can then collect logs, memory, and process details before remediation or reimaging.
- ✗
Power off the workstation immediately to ensure the malicious process stops.
Why it's wrong here
Powering off the workstation kills the process, but it destroys volatile evidence in RAM—including memory-resident payloads, active network handles, and decrypted command-and-control traffic—that is essential for reconstructing how the PowerShell process was launched and what it did. Unlike EDR isolation, which severs network paths while keeping the host powered on for memory acquisition and log capture, hard power-off loses the very data needed to determine scope. In incident response, preserving evidence precedes killing the process unless immediate physical safety or encryption risk demands otherwise.
- ✗
Create a permanent firewall rule that allows the unfamiliar IP address so you can observe more traffic.
Why it's wrong here
Creating a permanent firewall rule that allows the unfamiliar IP is effectively granting the attacker a persistent foothold and active command-and-control channel, which increases the blast radius and contradicts the primary incident response goal of containment. Observing hostile traffic should only be done in a controlled sandbox or honeypot with network segmentation, not on a production workstation where the encoded PowerShell can continue executing. The rule also overwrites or obscures existing evidence and may inadvertently permit follow-on attacks such as ransomware deployment or data staging.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Firewall rule
A firewall rule is a set of conditions that tells a firewall which network traffic to allow or block based on attributes like source, destination, port, and protocol.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst confirms that a workstation is encrypting local files and attempting SMB connections to nearby hosts. The user is still logged in, and the business wants to limit spread without destroying evidence. What is the best immediate action?
medium- A.Power the workstation off immediately and leave it in place
- ✓ B.Quarantine the workstation from the network using EDR or switch port containment
- C.Run a full antivirus scan while the workstation remains connected
- D.Wipe and reimage the workstation from a standard build image
Why B: Quarantining the workstation via EDR or switch port containment immediately stops the SMB-based lateral movement and further encryption of network shares, while preserving the volatile evidence (memory, running processes, encryption keys) for forensic analysis. This aligns with the business requirement to limit spread without destroying evidence, as powering off or reimaging would lose critical forensic data.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.