SY0-701 Security Operations Practice Question
EDR flags a word processor that launched encoded PowerShell and then made an outbound HTTPS connection to a rare domain. Which two actions should the analyst take first from the EDR console? Select two.
⚠ Common exam trap
The trap here is that candidates may prioritize remediation (uninstalling or rebooting) over containment and evidence preservation, failing to recognize that isolation and data collection are the mandated first steps in incident response according to NIST SP 800-61.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the endpoint from the network to stop further communication and lateral movement.
Isolating the endpoint from the network immediately stops the outbound HTTPS connection to the rare domain, preventing data exfiltration and blocking potential lateral movement. This is a critical first step in containment, as the encoded PowerShell and rare domain strongly suggest a malicious payload or C2 communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the endpoint from the network to stop further communication and lateral movement.
Why this is correct
This is the primary containment action because the host shows behavior consistent with active compromise and command execution. Network isolation limits attacker reach, preserves the current state, and reduces the chance of credential theft or lateral movement. EDR-based isolation is fast, reversible, and appropriate before more invasive remediation steps.
- ✓
Collect a live response package or volatile data from the host before remediation begins.
Why this is correct
Collecting live response data preserves valuable evidence such as running processes, network connections, loaded modules, and persistence artifacts. Because the system is still active, those details may disappear after reboot or cleanup. Capturing them early supports root-cause analysis and can help determine whether the attack used additional tools or credentials.
- ✗
Uninstall the word processor immediately because it is the process that launched PowerShell.
Why it's wrong here
Removing the application does not address the active incident and may destroy useful forensic evidence. The suspicious behavior came from the execution chain, not necessarily a permanently malicious application. The analyst should contain first and gather evidence, then decide on removal or repair based on findings.
- ✗
Reboot the laptop right away to clear the encoded PowerShell process from memory.
Why it's wrong here
A reboot can wipe volatile evidence, terminate active connections, and make investigation harder. It may also fail to stop persistence mechanisms or scheduled tasks that reactivate the malware after startup. Containment and evidence capture should happen before any reboot unless a specific safety issue demands it.
- ✗
Whitelist the rare domain temporarily to see whether the connection is business-related.
Why it's wrong here
Whitelisting a suspicious domain during an active incident is risky and could give the attacker continued access. If the domain is malicious, that action would expand exposure instead of reducing it. Analysts should validate the communication through logs, threat intelligence, and containment workflows rather than enabling it.
Go deeper
Related to this question
Learn chapter
Endpoint Detection and Response (EDR)
Key term
EDR
Endpoint Detection and Response (EDR) is a cybersecurity technology that continuously monitors endpoint devices to detect, investigate, and respond to advanced threats.
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.