EDR event timeline: 14:02:11 excel.exe spawned powershell.exe with -enc parameter 14:02:13 powershell.exe created scheduled task: "OneDrive Update" 14:02:18 explorer.exe began renaming multiple .docx files to .lock 14:02:21 outbound HTTPS connection to 198.51.100.77:443 14:02:24 security service attempted to terminate, then recovered
Based on the exhibit, what is the BEST immediate containment action?
The workstation is still powered on, and the user reports that files are being renamed and the system is running very slowly. The security analyst confirms malicious activity is in progress.
Answer choices
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
Immediately isolate the endpoint from the network using EDR containment or switch quarantine.
The device is actively exhibiting ransomware-like behavior, and isolation stops lateral spread and additional command-and-control traffic while preserving the powered-on system for later review.
Power off the workstation immediately to prevent any further file changes.
Shutting down can interrupt the malware, but it also destroys volatile evidence and is usually not the first choice when containment can be achieved remotely.
Uninstall Microsoft Office so the malicious spreadsheet cannot launch again.
Removing the office suite does not contain the incident in real time and does not stop current encryption or outbound malicious traffic.
Block the destination IP address at the firewall and wait for the user to log off.
Blocking one destination may help, but waiting leaves the compromised host connected and capable of spreading or encrypting additional data.
Common exam trap
NAT is not only about the public address. The inside/outside interface roles and the ACL or rule that matches traffic are just as important.
Technical deep dive
NAT questions usually test address translation, overload/PAT behaviour, static mappings and whether the right traffic is being translated. Read the interface direction and address terms carefully.
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SY0-701 questions linked to Security+ social engineering questions.
Practise SY0-701 questions linked to Security+ cryptography.
Practise SY0-701 questions linked to Security+ IAM questions.
Practise SY0-701 questions linked to Security+ risk management questions.
Practise SY0-701 questions linked to Security+ incident response questions.
Practise SY0-701 questions linked to Security+ malware questions.
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practise SY0-701 questions linked to Security+ security operations questions.
Practise SY0-701 questions linked to Security+ zero trust questions.
Practise SY0-701 questions linked to Security+ authentication factors questions.
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
Question 2
Question 3
Question 4
Question 5
Question 6
FAQ
Static NAT maps one inside address to one outside address.
The correct answer is: Immediately isolate the endpoint from the network using EDR containment or switch quarantine. — The event sequence strongly suggests active malware with ransomware behavior: encoded PowerShell, persistence via scheduled task, file renaming, and outbound beaconing. The best immediate action is to isolate the endpoint through EDR or network quarantine. That contains the threat quickly, limits lateral movement, and preserves the machine in a live state for follow-up analysis. It is more effective than waiting for the user to disconnect or making disruptive changes that do not stop the incident promptly. Why others are wrong: Powering off may be appropriate in some cases, but it sacrifices volatile evidence and is not the best first containment step when remote isolation is available. Uninstalling Office does not stop the current malicious process or the scheduled task. Blocking the source IP helps, but it is incomplete if the host can still reach other internal systems or if the malware switches infrastructure.
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Sign in to join the discussion.