SY0-701 Security Operations Practice Question
Exhibit
Host: eng-lt-44 Containment status: network quarantined Registry artifact: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Updater = C:\Users\maria\AppData\Roaming\update.exe Scheduled task: TaskName: SysMaint Action: C:\Users\maria\AppData\Roaming\update.exe /svc Trigger: every 30 minutes File hash: update.exe SHA256 matches known malware family 'QuillDoor' User impact: - Browser pop-ups observed earlier - No confirmed encryption - No evidence of additional hosts compromised
Based on the exhibit, what is the best eradication decision after containment?
A quarantined endpoint was found to have a malicious startup item and a scheduled task. The team has already isolated it from the network and preserved memory for analysis.
⚠ Common exam trap
It's easy for candidates to choose Option A, thinking that deleting the malicious file is sufficient, but CompTIA emphasizes that persistence artifacts must be removed and a system should be rebuilt from a trusted image to ensure complete eradication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove persistence artifacts and rebuild the endpoint from a known-good image before returning it to service.
After containment (network isolation and memory preservation), the best eradication step is to remove all persistence mechanisms (startup item and scheduled task) and rebuild the endpoint from a known-good image. This ensures that any undetected malware remnants, rootkits, or hidden artifacts are eliminated, preventing reinfection. Simply deleting files or changing DNS does not guarantee the system is clean, and reconnecting without a full rebuild risks lateral movement or data exfiltration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete only the update.exe file and reconnect the host once the user confirms it is working.
Why it's wrong here
Deleting only update.exe is insufficient because the exhibit shows two separate persistence mechanisms (e.g., a scheduled task and a Run registry key) that will re-launch the payload or re-download it on reboot. Even if the user confirms the host appears functional, a rootkit or tampered system files could remain undetected, allowing an attacker to regain a foothold. Eradication demands that every persistence vector be neutralized, not just the original file, which is why reimaging is the only reliable cleanup strategy.
- ✓
Remove persistence artifacts and rebuild the endpoint from a known-good image before returning it to service.
Why this is correct
The host contains a malicious executable plus two persistence mechanisms, so cleanup must remove more than the payload file. Reimaging from trusted media provides the most reliable eradication path, especially when the malware family is already identified and the machine has been quarantined. This reduces the chance of hidden remnants, registry persistence, or tampered system components surviving the response effort.
- ✗
Restore network connectivity now because no encryption was observed.
Why it's wrong here
Restoring network connectivity solely because no encryption was observed is dangerously premature. The malware may have already performed credential dumping, reconnaissance, or lateral movement, and the persistence artifacts still present give the attacker an active channel to return. Without encryption, the compromise could still be used for silent C2 callbacks or data exfiltration, so the host must remain quarantined until it is properly eradicated and rebuilt from a known-good source.
- ✗
Change the DNS servers for the entire enterprise to block the malware domain.
Why it's wrong here
Changing DNS servers for the entire enterprise is a network-level containment action, not an eradication decision. It might temporarily disrupt the malware's ability to resolve its C2 domain, but the endpoint remains infected and its persistence mechanisms still allow the payload to run or update. Moreover, modern malware often uses hard-coded IP addresses or alternative resolution methods, so DNS blocking provides no guarantee of breaking the kill chain and can impact legitimate business operations across the company.
Go deeper
Related to this question
Learn chapter
Endpoint Detection and Response (EDR)
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
Key term
Persistence
Persistence is the set of techniques attackers use to maintain long-term access to a compromised system even after reboots or credential changes.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.