SY0-701 Security Operations Practice Question
Exhibit
EDR timeline - WS-224 11:07 User opened invoice.docm 11:08 winword.exe spawned powershell.exe -enc <redacted> 11:09 PowerShell created C:\ProgramData\updater.vbs 11:10 Scheduled task 'UpdaterSvc' created to run at logon 11:12 Outbound connection blocked to 203.0.113.77:8443 11:14 Host isolated from the network 11:16 Memory capture completed Analyst note: The workstation was used for finance approvals during the last hour. No other hosts have shown the same indicators yet.
Based on the exhibit, which action should the incident response team take next to eradicate the threat?
⚠ Common exam trap
Candidates often think deleting the scheduled task (Option B) is sufficient for eradication, but CompTIA emphasizes that any confirmed compromise requires full reimaging to ensure no hidden persistence remains.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reimage the endpoint from a known-good build and reset potentially exposed credentials.
The exhibit indicates a confirmed compromise (e.g., a scheduled task establishing outbound C2 traffic). Eradication requires removing all traces of the attacker's foothold, which is best achieved by reimaging the endpoint from a known-good build. Additionally, any credentials that may have been exposed during the compromise must be reset to prevent lateral movement or re-entry.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Return the workstation to the user since the outbound connection was blocked.
Why it's wrong here
Blocking one outbound connection does not remove persistence or confirm the system is clean. The exhibit shows script-based activity and a scheduled task, both of which can remain active even after network containment. Returning the device now would risk reinfection or continued compromise.
- ✗
Delete only the scheduled task and reconnect the host to monitor for more alerts.
Why it's wrong here
Removing one artifact is too narrow when the evidence suggests a broader compromise. The PowerShell payload created a script file and a scheduled task, so there may be additional persistence, credential theft, or payload changes. Reconnecting the host early increases the chance of further impact.
- ✓
Reimage the endpoint from a known-good build and reset potentially exposed credentials.
Why this is correct
The logs show a likely malicious macro, encoded PowerShell, a dropped script, and persistence through a scheduled task. That combination indicates a high-confidence compromise with uncertain scope. Reimaging removes hidden persistence more reliably than piecemeal cleanup, and credential resets are appropriate because finance activity occurred on the device and credentials may have been captured.
- ✗
Close the incident because memory capture has already preserved the evidence.
Why it's wrong here
Preserving evidence is only one step in the process. The team still needs eradication and recovery actions before the incident can be closed. The host remains compromised until the malicious code and persistence mechanisms are removed and exposed credentials are addressed.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.