SY0-701 Security Operations Practice Question
EDR flags a workstation after a word processor launches encoded PowerShell and the host begins contacting a rare domain over HTTPS. The user is still active. What is the best containment action from the EDR console?
⚠ Common exam trap
Candidates often choose to kill the process or power off the system, mistakenly believing that stopping the immediate malicious activity is sufficient, without understanding that containment must preserve forensic evidence and prevent re-infection or lateral movement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the endpoint from the network while keeping it powered on.
Isolating the endpoint from the network while keeping it powered on is the best containment action because it immediately cuts off the command-and-control (C2) communication over HTTPS to the rare domain, preventing further data exfiltration or lateral movement, while preserving volatile memory and running processes for forensic analysis. This aligns with incident response best practices where containment must prioritize stopping the threat without destroying evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the endpoint from the network while keeping it powered on.
Why this is correct
This is the best containment step because it stops the suspected malware from communicating outward or moving laterally, while preserving the live system for follow-up investigation. Keeping the machine powered on protects volatile evidence such as memory, processes, and active connections. EDR isolation is especially useful when the user is still logged in and the host may still contain useful artifacts that would be lost by immediate shutdown.
- ✗
Delete the suspicious PowerShell process from the console and close the alert.
Why it's wrong here
Terminating the PowerShell process from the EDR console may stop the current execution, but it does not remove any fileless payloads, scheduled tasks, WMI event subscriptions, or registry Run keys the script may have created. With the alert closed and no isolation in place, the endpoint remains on the network, allowing any residual malware to continue beaconing or move laterally. This action also discards the live process memory that could reveal the encoded script's decrypted form, so it destroys volatile evidence without achieving containment.
- ✗
Reimage the workstation immediately to return it to a clean state.
Why it's wrong here
Reimaging the workstation immediately is a destructive recovery step that wipes the disk and, in effect, destroys the very artifacts needed to determine the root cause, scope, and indicators of compromise. While a clean build may be the eventual remediation, doing it before isolating and collecting forensic data can obscure whether the infection spread to other systems or originated from a network share. It also eliminates the opportunity to validate whether the EDR alert was a true positive versus a false positive, making containment decisions based on incomplete information.
- ✗
Power the workstation off and disconnect the SSD to preserve data.
Why it's wrong here
Powering off the workstation and disconnecting the SSD preserves the disk state but sacrifices the contents of RAM, which may contain the encoded script's decrypted payload, injected shellcode, active network connections, and encryption keys if full-disk encryption is in use. This volatile data is often the only source to confirm the attacker's technique and intent, and a hard shutdown prevents live triage of running processes. EDR-based isolation is preferable because it severs the network path while keeping the host powered, so first responders can acquire memory and conduct a live analysis before deciding on any hardware changes.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.