SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Reboot immediately to prevent any further damage from the suspected malware.

  Why it's wrong here

  Rebooting the system prematurely is a common but destructive reaction: it clears RAM, kills active processes, and resets kernel objects, which can destroy the only copies of malware payloads, in-memory encryption keys, or command-and-control channel state. Volatile data such as the ARP cache, active TCP connections, and process arguments exist only in memory and vanish instantly with a restart. Instead of containing the threat, a reboot gives persistent malware a fresh start to hide or escalate, and it forfeits the primary evidence needed to determine the infection's origin and scope.

• ✓

  Capture volatile evidence and document the system state before containment actions.

  Why this is correct

  This is the correct next step because evidence preservation comes before intrusive remediation when a system is still live. Memory, running processes, active network connections, and logged-on sessions may reveal malware behavior and scope. Documenting the time, state, and actions taken also supports the incident response process and helps preserve the integrity of later findings if the case requires internal review or legal action.

• ✗

  Copy suspicious files to a shared drive and continue normal operations.

  Why it's wrong here

  Copying suspicious files to a shared drive contaminates the evidence chain by changing file system metadata (creation, modified, and access timestamps) and may inadvertently spread the infection if the share is reachable by other hosts. This approach also keeps the affected system running, allowing malware to continue network communication, credential theft, or lateral movement while the analyst works. A proper response requires a forensically sound bit-for-bit image to an isolated storage device, preserving metadata and avoiding network exposure.

• ✗

  Run a full disk cleanup to remove temporary files and reduce risk.

  Why it's wrong here

  Running a full disk cleanup on a potentially compromised finance workstation is an anti-forensic act: it deliberately deletes temporary folders, prefetch files, browser caches, and thumbnails that frequently contain the initial infection vector, attacker tooling, or signs of data staging. Utilities like Disk Cleanup also perform write operations across the filesystem, altering modification times and overwriting unallocated space where deleted artifacts may reside. This destroys the very remnants that a malware investigation depends on to establish a timeline, identify the malware, and recover stolen data.