Restore the workstation from backup immediately before preserving any evidence.

Immediate restoration could destroy forensic evidence and does not stop the attacker from continuing lateral movement elsewhere.

Run a vulnerability scan against the subnet to see whether the malware exploited an unpatched service.

That may help later in root cause analysis, but it is not the priority while the compromise is still active.

Notify users to ignore the issue until the next maintenance window because the incident is likely self-limiting.

The logs show ongoing malicious activity, so waiting would increase business impact and spread risk significantly.

What does this SY0-701 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Isolate the host from the network and revoke its remote access to stop further spread. — The correct immediate action is containment. The exhibit shows active encryption-like behavior, a suspicious script launched from a document, and SMB connections to other internal hosts, which suggests the threat is still moving. Isolating the endpoint and revoking its remote connectivity helps prevent further spread while the team preserves evidence for later eradication and recovery steps. In incident response, stopping damage comes before rebuilding systems. Why others are wrong: Option B is premature because restoring before containment and evidence collection can erase useful artifacts and allow the attacker to persist elsewhere. Option C is useful only after the threat is contained; scanning the subnet does not stop active spread. Option D is unsafe because the behavior is not self-limiting, and delaying action would likely increase the scope of compromise.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.