SY0-701 Security Operations Practice Question
EDR detects encoded PowerShell launched from a word processor, a process attempt to read LSASS memory, and an outbound HTTPS connection to a rare domain. What should the analyst do first?
⚠ Common exam trap
It's easy for candidates to choose reboot (D) thinking it clears malware, but CompTIA emphasizes preserving evidence and containing the threat first, as rebooting destroys volatile data needed for forensic analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the endpoint from the network while keeping it powered on for investigation.
The EDR alerts indicate a likely credential theft attempt (LSASS read) and C2 communication (rare domain). Isolating the endpoint preserves forensic evidence in memory and disk while preventing further data exfiltration or lateral movement, which is the immediate containment priority per incident response best practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the endpoint from the network while keeping it powered on for investigation.
Why this is correct
This is the correct first action because the host shows clear signs of active compromise and possible credential theft. Network isolation limits further spread and command-and-control activity, while leaving the system powered on preserves volatile evidence for later analysis. That balance supports both containment and investigation, which is the right sequence when EDR indicates live malicious behavior.
- ✗
Delete the user's profile to stop the malicious process immediately.
Why it's wrong here
Deleting the user's profile is a destructive remediation action that will not stop the encoded PowerShell process already running in memory, nor will it remove persistence mechanisms that may reside in the registry, WMI, or scheduled tasks outside the profile. This action irreversibly destroys NTUSER.DAT, browser cache, and other profile-based artifacts that are critical forensic evidence for determining the attack vector and scope of compromise. Because it neither contains the active threat nor preserves evidence, it is an inappropriate first step in incident response.
- ✗
Patch the word processor before reviewing any alerts or logs.
Why it's wrong here
Patching the word processor only addresses the initial vulnerability that likely delivered the encoded PowerShell; it does not interrupt the currently executing malicious process or cut off the attacker's existing command-and-control channel. Running a patching process during active incident response also changes file hashes, timestamps, and system state, which can corrupt potential forensic evidence and obscure the root cause analysis. The correct sequencing is to isolate the host first to stop further damage, then investigate and remediate; patching is a preventive measure applied after the threat has been fully contained and understood.
- ✗
Reboot the system immediately to clear anything running in memory.
Why it's wrong here
Rebooting immediately destroys the volatile memory where the decoded PowerShell script, injected payloads, active network connections, and other real-time indicators reside, eliminating the most valuable evidence for incident analysis. Since the attacker likely established persistence through mechanisms like run keys, WMI subscriptions, or scheduled tasks, a reboot may simply restart the malicious process and restore command-and-control, allowing the threat to continue unchecked. Isolation keeps the system powered on and blocks network communication, giving responders the chance to acquire memory and analyze the live compromise without the risk of the attacker returning.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.