SY0-701 Security Operations Practice Question
EDR reports that a workstation launched PowerShell from a word processor, created a scheduled task named WinUpdateSvc, and began making repeated HTTPS connections to a rare external domain. The user is still logged in to several cloud apps. Which two response actions are best to initiate from the EDR console? Select two.
⚠ Common exam trap
Many candidates think deleting the scheduled task (Option C) is sufficient to remediate, but the exam emphasizes that removing artifacts without addressing the root cause is ineffective, and that isolation and forensic collection are the correct first steps in incident response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the endpoint from the network to stop further communication and lateral movement.
Isolating the endpoint from the network immediately stops the active HTTPS command-and-control (C2) communication and prevents lateral movement to other systems. Given the suspicious chain (word processor spawning PowerShell, creating a scheduled task, and connecting to a rare external domain), this is a strong indicator of a malware infection or unauthorized remote access. Isolation preserves the forensic state while cutting off the attacker's access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the endpoint from the network to stop further communication and lateral movement.
Why this is correct
Isolation is the fastest way to contain a compromised endpoint when the device is still active. It prevents additional command-and-control traffic, reduces the chance of lateral movement, and can be done without immediately shutting down the machine. This is the primary EDR containment action in a live incident.
- ✓
Collect an EDR triage package or memory-focused artifact before powering the device off.
Why this is correct
A triage package preserves valuable live-response evidence such as process lists, persistence artifacts, network connections, and sometimes memory-related data. Capturing this information before power loss improves later investigation and scoping. It is the right complement to isolation when the system is still accessible.
- ✗
Delete the scheduled task immediately so the host returns to normal operation.
Why it's wrong here
Deleting artifacts too early can destroy evidence and does not guarantee the malware is removed. It may also cause the attacker to react or trigger secondary payloads. Containment and collection should come before destructive cleanup.
- ✗
Reimage the workstation from the golden image as the first response.
Why it's wrong here
Reimaging the workstation from a golden image is a remediation step that destroys the very evidence needed to understand the breach. First response should preserve volatile data—memory, event logs, PowerShell history, and prefetch files—so analysts can identify the attack vector, lateral movement, and command-and-control infrastructure. While reimaging guarantees a clean OS, it does not address attacker persistence elsewhere on the network, and the same compromise could simply reoccur. Rapid reimaging without evidence collection is a classic incident response failure that erases forensic artifacts and hinders attribution.
- ✗
Ignore the alert because the PowerShell binary is built into Windows and therefore safe.
Why it's wrong here
Dismissing the alert because PowerShell is a signed Microsoft binary ignores how attackers use built-in tools to live off the land. PowerShell is frequently abused to download payloads, execute base64-encoded commands, and perform process injection while evading signature-based defenses. The EDR alert is based on a behavior chain—Word spawning PowerShell with suspicious network beaconing, not merely the presence of the binary—so the existence of the executable is not an indicator of safety. Ignoring the alert without inspecting the parent process, command-line arguments, or network activity risks letting an active compromise continue undetected.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.