SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Isolate the workstation from the network using the EDR tool.

  Why this is correct

  This is the best immediate containment step because it stops the workstation from communicating with a possible attacker while preserving the system for further analysis. EDR isolation is designed for exactly this type of suspicious endpoint behavior. It limits lateral movement, reduces data exfiltration risk, and gives responders time to investigate before deciding on cleanup or reboot actions.

• ✗

  Wait for another alert before taking any action.

  Why it's wrong here

  Taking a passive posture after an EDR alert is operationally unsafe because the suspicious process remains active and may be conducting reconnaissance, credential harvesting, or data exfiltration in real time. EDR telemetry is intended to trigger immediate investigation and containment, not to wait for corroborating alerts that may only confirm damage already done. Each minute of delay increases the window for lateral movement to critical assets, and the absence of a second alert does not imply the absence of malicious activity.

• ✗

  Delete the word processor immediately.

  Why it's wrong here

  Deleting the word processor is a destructive recovery action, not a containment action, and it eliminates the very binary, configuration files, and logs in the application data folders that would reveal how the process was exploited or abused. It also fails to stop an already-injected malicious thread or fileless payload that lives in memory, meaning the active threat can persist even after the file is removed. Furthermore, immediate deletion can trigger tampering indicators, complicate chain-of-custody, and remove evidence needed to attribute the attack or recover legitimate files that the malware may have been using.

• ✗

  Reboot the workstation to see if the behavior happens again.

  Why it's wrong here

  Rebooting the workstation clears volatile memory, which is exactly where malware execution details—such as injected code, decrypted payloads, and active network connections—reside, leaving responders with only disk evidence that may be incomplete or obfuscated. It also does not address persistence mechanisms already present in the registry or startup folders, so the malicious process can simply relaunch on the next boot, making the behavior appear to 'stop' while the compromise remains. This approach sacrifices forensic integrity and fails to contain any ongoing network-based threat, violating the fundamental IR priority to preserve evidence while reducing impact.