SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Isolate the endpoint from the network through the EDR platform

  Why this is correct

  Endpoint isolation via the EDR agent should be the immediate response because it severs active command-and-control channels and prevents lateral movement to adjacent hosts, while the management plane remains available for authorized forensic actions. Unlike unplugging the network cable, EDR-based isolation allows the responder to push collection tools or pull telemetry, preserving the host's state for memory analysis. This containment step aligns with incident response priorities: stop the spread before eradication, and retain visibility into the attacker's activity.

• ✓

  Collect a triage package or memory snapshot before remediation, if supported

  Why this is correct

  Collecting a triage package or memory snapshot before any remediation captures volatile artifacts such as the decoded PowerShell process, injected shellcode, open network sockets, and parent-child process relationships that disappear when the host is shut down or cleaned. These artifacts are essential for determining the full kill chain, identifying the C2 server, and validating whether the encoded script escalated privileges or dropped additional payloads. Memory forensics follows the order of volatility, and if the EDR platform supports it, taking a snapshot now ensures that even if isolation causes the malicious process to exit, the evidence is preserved.

• ✗

  Uninstall the spreadsheet application immediately

  Why it's wrong here

  Uninstalling the spreadsheet application is an ineffective response because the malicious PowerShell process is already running in memory and will not terminate merely because its parent application is removed. This action can also delete the original macro-enabled document, which is a critical piece of evidence for determining the delivery mechanism and the attacker's social engineering lure. Furthermore, forcibly removing software may trigger self-protection or tamper defenses, and it bypasses the proper containment and eradication sequence.

• ✗

  Reboot the endpoint to clear the suspicious script

  Why it's wrong here

  Rebooting the endpoint clears volatile memory, which destroys the very artifact the security team needs to analyze, such as the decoded PowerShell script and any injected code that was never written to disk. Many malware families use persistence mechanisms like scheduled tasks or registry run keys, so a reboot may simply relaunch the malicious process and give it a clean start. Rebooting does nothing to sever network connectivity or prevent lateral movement, so it fails as an initial containment step and can severely degrade forensic value.

• ✗

  Wait for a second alert before taking any action

  Why it's wrong here

  Waiting for a second alert is contrary to the principle of rapid containment because an encoded PowerShell launch from a spreadsheet is already a high-fidelity indicator of malicious activity, likely linked to a phishing campaign. The delay allows the attacker additional time to exfiltrate data, move laterally, or deploy ransomware, and it makes later attribution more difficult as logs and memory are overwritten. A definitive verdict should be made on the current evidence, and if the EDR verdict is uncertain, the correct action is to isolate while investigating, not to defer action.