SY0-701 Security Operations Practice Question
EDR shows encoded PowerShell launched by a word processor and an outbound connection to a rare domain. What is the best immediate containment action?
⚠ Common exam trap
Many candidates choose a broad administrative action (like uninstalling software or sending user notices) instead of the precise, immediate technical containment step that stops the active threat at the network level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the endpoint from the network using the EDR console.
Isolating the endpoint from the network using the EDR console is the best immediate containment action because it stops the outbound connection to the rare domain, preventing potential command-and-control (C2) communication or data exfiltration. The encoded PowerShell launched by a word processor strongly suggests a malicious macro or exploit, and isolating the host contains the threat without disrupting the entire network. This aligns with the incident response priority of containment before eradication or recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the endpoint from the network using the EDR console.
Why this is correct
Network isolation through EDR quickly limits attacker access and prevents further command-and-control communication. It also preserves the host for investigation while stopping spread to other systems. This is a standard first containment step when behavior strongly suggests active compromise.
- ✗
Uninstall the word processor from every workstation.
Why it's wrong here
Uninstalling the word processor from every workstation is a broad, irreversible change-management action that does not interrupt the already-running encoded PowerShell process or terminate the established outbound connection to the suspicious domain. It also alters the system state and may destroy volatile forensic evidence needed for attribution. Proper containment isolates the specific compromised endpoint first, preventing lateral movement while preserving the integrity of the investigation.
- ✗
Wait to see whether more alerts appear before responding.
Why it's wrong here
Waiting is contrary to the containment phase of incident response. The combination of encoded PowerShell and communication with a rare external domain is a strong indicator of active compromise; delay allows the adversary to complete reconnaissance, move laterally via SMB or PsExec, or exfiltrate data. The existing EDR alert is already sufficient to trigger a hold-and-contain action, and additional telemetry can be collected after network isolation without risking further spread.
- ✗
Send a notice to all users reminding them not to open attachments.
Why it's wrong here
A mass email reminder to users is a security-awareness action that addresses potential future behavior but does nothing to halt the active malicious process on the compromised host. The endpoint is already infected, and the attacker's beacon will continue to receive commands, allowing the host to be used as a pivot for lateral movement. Operational containment through EDR network isolation must take precedence; user education is a complementary post-incident activity, not a first-response measure.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.