SY0-701 Security Operations Practice Question
Exhibit
Host: finance-lap07 10:22:11 winword.exe spawned powershell.exe -enc <redacted> 10:22:14 powershell.exe created C:\Users\ana\AppData\Roaming\rclone.exe 10:24:02 file rename activity: 184 files changed to *.locked 10:24:09 outbound SMB connections to 10.20.4.18 and 10.20.4.19 10:25:01 EDR status: endpoint still connected to corporate VPN User report: 'My shared files stopped opening and the folder names changed.'
Based on the exhibit, what is the best immediate action for the SOC or IR team?
A finance workstation shows evidence of a macro-launched script, followed by file renaming and lateral SMB traffic to two other hosts. The team has not yet determined the full scope of the incident.
⚠ Common exam trap
Many exam-takers choose Option C (vulnerability scan) because they think identifying the root cause is the priority, but in an active incident with lateral movement, containment (isolation) must come first per the NIST SP 800-61 incident response framework.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the host from the network and revoke its remote access to stop further spread.
The exhibit shows a macro-launched script, file renaming, and lateral SMB traffic to two other hosts, indicating active lateral movement. Isolating the host (e.g., via network access control or disabling the switch port) immediately stops the spread of the malware to other systems, preserving the ability to investigate without further compromise. This aligns with the first step in incident response: containment before eradication or recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the host from the network and revoke its remote access to stop further spread.
Why this is correct
Isolate the host from the network and revoke its remote access to stop further spread. This is the immediate containment step in incident response. By severing the network connection, you halt active SMB propagation to neighboring systems, and revoking remote access eliminates the attacker's control channel. Containment takes priority over analysis while the compromise is actively encrypting files and moving laterally.
- ✗
Restore the workstation from backup immediately before preserving any evidence.
Why it's wrong here
Restoring the workstation from backup immediately before preserving any evidence would destroy volatile data such as running processes, open network connections, and memory-resident malware. It also fails to stop the attacker, who may still have remote access or persistence on other hosts. Even if backups are clean, restoration must wait until forensic evidence is collected and the attacker's access is revoked across the environment.
- ✗
Run a vulnerability scan against the subnet to see whether the malware exploited an unpatched service.
Why it's wrong here
Running a vulnerability scan against the subnet is a reconnaissance activity that could alert the attacker and generate additional network noise, obscuring the original attack path. While it may help identify an unpatched service later for root cause, it does nothing to contain the active encryption and lateral movement currently underway. Eradication and recovery phases can include vulnerability assessment, but only after containment is achieved.
- ✗
Notify users to ignore the issue until the next maintenance window because the incident is likely self-limiting.
Why it's wrong here
Notifying users to ignore the issue until the next maintenance window is dangerous because the logs demonstrate ongoing malicious activity, not a self-limiting event. Waiting allows the ransomware to continue encrypting files and the SMB worm to infect more hosts, potentially causing irreversible data loss and widespread business disruption. Incidents rarely self-limit; they expand until contained, so this option increases risk and impact significantly.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A file server is actively renaming documents and generating ransom notes. The server hosts a shared drive used by finance, and users are still online. What is the best immediate action?
medium- A.Shut the server down immediately to stop all activity as fast as possible.
- ✓ B.Isolate the server from the network to contain the spread while preserving evidence.
- C.Restore the file server from backup before checking whether the infection is still active.
- D.Run a full antivirus scan and wait for the results before taking any other action.
Why B: Isolating the server from the network stops the ransomware from encrypting more files or spreading laterally, while preserving volatile evidence (e.g., running processes, memory contents) needed for forensic analysis. In a live incident, immediate disconnection (not shutdown) is the standard containment step per NIST SP 800-61 and SANS incident response guidelines, as it halts the attack without destroying data in memory or logs.
Variation 2. A file server begins encrypting documents, and the SOC confirms the activity is malicious. Which incident response step should happen first to limit further damage?
easy- A.Lessons learned
- ✓ B.Containment
- C.Recovery
- D.Post-incident reporting
Why B: Containment is the correct first step because it isolates the compromised file server from the network, preventing the ransomware from encrypting additional shares or spreading laterally. The SMB protocol (port 445) used for file sharing would be blocked at the switch or firewall, halting further encryption of documents. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.
Variation 3. A user reports a suspicious pop-up on a workstation and the SOC suspects malware. Which action should the responder take first to contain the threat?
easy- ✓ A.Disconnect the workstation from the network
- B.Wipe the workstation immediately
- C.Return the workstation to the user after restarting it
- D.Wait until the next patch cycle to see if the issue disappears
Why A: Disconnecting the workstation from the network immediately isolates the suspected malware, preventing it from communicating with command-and-control (C2) servers, spreading laterally to other hosts, or exfiltrating data. This is the first step in the NIST incident response containment phase, as it stops network-based propagation without destroying forensic evidence.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.