SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Reboot the endpoint to terminate the suspicious processes

  Why it's wrong here

  Rebooting the endpoint terminates the visible PowerShell child process, but it also destroys the volatile evidence needed to determine the full scope of the attack—the encoded payload, injected shellcode, and active network sessions live only in memory. More importantly, most malware families install persistence mechanisms (scheduled tasks, Run keys, WMI event subscriptions, or services) that survive a reboot and immediately re-establish a new process, so the attacker is not actually removed. Rebooting also severs the current C2 channel, which can cause the adversary to trigger destructive actions, and it does nothing to prevent lateral movement from other already-compromised hosts.

• ✓

  Isolate the endpoint from the network while keeping it powered on

  Why this is correct

  Network isolation stops the endpoint from reaching the attacker's command-and-control server and blocks lateral movement to other systems, while keeping the machine powered on preserves the volatile memory contents needed for forensic analysis (processes, injected code, network connections). This is an active containment action that does not delete on-disk artifacts or kill the live processes prematurely, so the response team can capture a memory dump and inspect the encoded PowerShell payload in its original context. On managed endpoints this is accomplished via EDR-integrated network quarantine, which applies a host firewall deny-all rule at the virtual switch or agent level rather than physically disconnecting the cable.

• ✗

  Uninstall the spreadsheet application immediately

  Why it's wrong here

  Uninstalling the spreadsheet application is an ineffective and premature remediation step because the malicious PowerShell payload has already been decoded and executed as separate processes in memory; removing the parent application does not terminate those child processes or the network connections they maintain. It also destroys application file artifacts, registry entries, and macro-related customization files that could be critical to reconstructing the threat, and it can increase attacker suspicion causing the malware to delete its own traces or escalate privileges. The correct priority is to first contain the active compromise by isolating the host from the network, then preserve evidence and perform malware analysis before any remediation.

• ✗

  Block the rare domain and close the alert

  Why it's wrong here

  Blocking the rare domain only denies a single network indicator while leaving the underlying malicious process alive and the host still under attacker control; modern C2 frameworks use domain rotation, DGA, or multiple fallback channels, so the malware will simply beacon to another destination or rely on its already-established interactive session. Closing the alert after this action is not a containment decision—it is a false sense of resolution, and the incident will remain active with persistence mechanisms and potential lateral movement still in progress. Proper incident response requires isolating the endpoint, preserving the encoded PowerShell payload for analysis, and verifying whether other hosts were contacted before any indicator block is used as a supplementary containment control.

Go deeper

Related to this question