Incident Response Containment: Isolate Workstation and Capture Volatile Evidence
An EDR alert shows a finance workstation launching rundll32 from %AppData%, creating a scheduled task, and making repeated HTTPS beacons to a rare domain. The user still has open accounting files, and the SOC wants to slow spread without losing evidence. What two actions should be taken first? Select two.
Quick Answer
The correct first actions are to isolate the workstation and capture volatile evidence. Isolating the workstation immediately cuts the HTTPS beacon traffic to the rare domain, severing the command-and-control communication and preventing lateral movement to other systems, while leaving the disk-based evidence intact for later analysis. Capturing volatile evidence—such as memory contents, running processes, and active network connections—is critical because this data disappears the moment the system is powered down or disconnected, and it holds the forensic keys to understanding the attack chain, including the rundll32 execution and scheduled task creation. On the Security+ SY0-701 exam, this scenario tests your understanding of the incident response containment steps and the priority of preserving volatile data over non-volatile data; a common trap is to immediately shut down the workstation, which destroys the very evidence needed for root-cause analysis. Remember the mnemonic “ICED” for incident response containment: Isolate, Capture volatile Evidence, then Document.
⚠ Common exam trap
It's easy for candidates to choose to power off the workstation (D) thinking it stops the malware, but this destroys volatile evidence and can trigger anti-forensic mechanisms, whereas isolation and memory capture are the correct first steps in incident response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation from the network using EDR or NAC containment.
Isolating the workstation (A) stops the malware from communicating with its C2 server via HTTPS beacons and prevents lateral movement, while preserving the evidence on disk. Capturing volatile evidence (C) before any shutdown or isolation ensures that memory-resident artifacts, active network connections, and running processes are preserved, which are critical for forensic analysis and understanding the attack chain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the workstation from the network using EDR or NAC containment.
Why this is correct
Isolating the host immediately stops most outbound command-and-control traffic and reduces the chance of lateral spread. It is the best first containment step when malware is still active. It preserves the system state better than power loss, which can destroy volatile evidence.
- ✗
Immediately wipe and reimage the workstation before collecting anything else.
Why it's wrong here
Reimaging removes the malware, but it also destroys important evidence and loses visibility into how the compromise occurred. That is a recovery step after containment and acquisition, not the first action when the endpoint is still active.
- ✓
Capture volatile evidence such as memory contents, running processes, and active network connections.
Why this is correct
Collecting volatile data while the machine is live preserves clues about injected code, memory-only malware, sockets, and active sessions. This supports later investigation and root-cause analysis. It is appropriate before shutdown when the organization wants to preserve evidence.
- ✗
Power the workstation off immediately to stop the malware process.
Why it's wrong here
Powering off may stop execution, but it also destroys volatile evidence and can interfere with understanding the infection. It is sometimes justified for safety, but it is not the best first choice when the host is still available for live response.
- ✗
Disable every user account in the finance department to prevent further compromise.
Why it's wrong here
A broad account shutdown would be disruptive and is not targeted to the likely infected host. Containment should start with the affected system and any confirmed compromised identities, rather than creating unnecessary business impact.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
EDR
Endpoint Detection and Response (EDR) is a cybersecurity technology that continuously monitors endpoint devices to detect, investigate, and respond to advanced threats.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. EDR alerts show a finance laptop spawning an unsigned executable from %AppData%, attempting to read LSASS memory, and making outbound HTTPS connections to a rare domain. The user says they only opened a spreadsheet attachment. What is the best immediate action?
medium- A.Reboot the laptop to clear any malicious process from memory.
- ✓ B.Isolate the laptop from the network using the EDR platform.
- C.Run a full antivirus scan and wait for the results before taking further action.
- D.Reset the user's password and keep the laptop online for monitoring.
Why B: The EDR alerts indicate a likely credential theft attempt (LSASS read) and C2 communication (rare domain). Isolating the laptop immediately stops data exfiltration and lateral movement, which is the priority before any remediation. Reboot, scan, or password reset would not prevent the attacker from already having access to credentials or the network.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.