EDR flags a word processor that launched encoded PowerShell and then made an outbound HTTPS connection to a rare domain. Which two actions should the analyst take first from the EDR console? Select two.

Uninstall the word processor immediately because it is the process that launched PowerShell.

Removing the application does not address the active incident and may destroy useful forensic evidence. The suspicious behavior came from the execution chain, not necessarily a permanently malicious application. The analyst should contain first and gather evidence, then decide on removal or repair based on findings.

Reboot the laptop right away to clear the encoded PowerShell process from memory.

A reboot can wipe volatile evidence, terminate active connections, and make investigation harder. It may also fail to stop persistence mechanisms or scheduled tasks that reactivate the malware after startup. Containment and evidence capture should happen before any reboot unless a specific safety issue demands it.

Whitelist the rare domain temporarily to see whether the connection is business-related.

Whitelisting a suspicious domain during an active incident is risky and could give the attacker continued access. If the domain is malicious, that action would expand exposure instead of reducing it. Analysts should validate the communication through logs, threat intelligence, and containment workflows rather than enabling it.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Isolate the endpoint from the network to stop further communication and lateral movement. — The best first actions are to isolate the endpoint and collect live response data. Isolation stops the suspicious host from communicating outward or moving laterally, while live-response capture preserves volatile evidence that could be lost during cleanup. In a case involving encoded PowerShell and a rare domain, both containment and evidence preservation are necessary to limit damage and support later investigation. Why others are wrong: Uninstalling the word processor, rebooting the host, or whitelisting the domain are all premature or risky. They either destroy evidence, fail to contain the threat, or potentially allow continued attacker communication. The correct sequence is to contain first, preserve volatile artifacts, and then remediate based on what the investigation reveals.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.