SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Reboot the laptop to clear any malicious process from memory.

  Why it's wrong here

  Rebooting the laptop is a destructive containment action that clears volatile memory (RAM), where live malware processes, injected code, and active network connections reside. This volatile evidence is lost forever, and if the adversary installed persistence mechanisms (e.g., scheduled tasks, registry Run keys, or services), the malicious executable will simply reload after startup, leaving the system re-infected. Incident responders need memory capture and live forensics before any shutdown, so rebooting immediately is counterproductive and can even give the attacker a clean-state advantage to evade detection.

• ✓

  Isolate the laptop from the network using the EDR platform.

  Why this is correct

  Network isolation immediately stops outbound command-and-control traffic and reduces the chance of lateral movement. It also preserves the endpoint for later forensics better than powering it off or wiping it. Because the host is still active, isolation is the safest containment step while the team gathers volatile evidence and decides on eradication.

• ✗

  Run a full antivirus scan and wait for the results before taking further action.

  Why it's wrong here

  Waiting for a full antivirus scan delays the most urgent goal: containing an active compromise. AV scans rely on signature or heuristics databases and can be evaded by polymorphic or fileless malware, and the scan may take many minutes or hours—time during which the malicious process can exfiltrate data or move laterally. While a scan may eventually identify the unsigned executable, it does not stop the already-running process from communicating with command-and-control servers or from encrypting files in a ransomware attack. This approach is a diagnosis step, not a first-response containment step, and should be performed only after network isolation.

• ✗

  Reset the user's password and keep the laptop online for monitoring.

  Why it's wrong here

  Resetting the user's password addresses credential theft but does nothing to sever the compromised host's current network communications. The unsigned executable is already running locally, and resetting the password will not terminate its process, clear its memory-resident payload, or block the outbound C2 channel it has already established. Keeping the laptop online for monitoring is especially dangerous because the attacker could use the machine as a pivot point to reach other systems on the network, while the password reset may also fail if the attacker has already created a backdoor account or dumped cached credentials. The first priority is to isolate the host, not to chase credentials.

Go deeper

Related to this question