Question 656 of 1,013
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
NetFlow shows one user workstation making authenticated SMB and WinRM connections to more than 40 internal hosts within 15 minutes, starting shortly after the user opened a spreadsheet attachment. No approved admin tool was running on the device. What is the best initial response?
⚠ Common exam trap
The trap here is that candidates see 'authenticated' and assume the traffic is legitimate, missing that attackers use valid stolen credentials to authenticate, making authentication alone an unreliable indicator of safety.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation and begin investigating for credential compromise or lateral movement
The sudden burst of authenticated SMB and WinRM connections from a single workstation to over 40 internal hosts immediately after opening a spreadsheet attachment is a classic indicator of lateral movement using stolen credentials. Since no approved admin tool was running, this behavior strongly suggests the user's credentials have been compromised, likely via a macro or exploit in the attachment, and an attacker is using those protocols to move laterally. Isolating the workstation stops the attack in progress and preserves evidence for forensic investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Treat the traffic as normal because the workstation used valid credentials
Why it's wrong here
Valid credentials only prove the session was authenticated, not that the access pattern is safe. A single user workstation reaching out to many internal SMB and WinRM endpoints in a short window is a classic lateral movement indicator, even if passwords or hashes are correct. Attackers often abuse stolen credentials or pass-the-hash techniques to move from a compromised host to other systems, so the anomaly should never be dismissed as normal traffic.
- ✓
Isolate the workstation and begin investigating for credential compromise or lateral movement
Why this is correct
Isolating the workstation is the correct immediate containment step because it stops the suspicious east-west traffic from reaching other internal hosts and preserves volatile evidence. After containment, investigate for credential theft, token abuse, or malware persistence by reviewing authentication logs, process execution, scheduled tasks, and network connections. This approach aligns with incident response best practices and the Security+ emphasis on minimizing scope before remediation.
- ✗
Increase the DHCP lease time to reduce network noise
Why it's wrong here
Changing the DHCP lease time only affects how long hosts retain IP address assignments and has no relationship to SMB or WinRM authentication behavior. It won't reduce the volume of authenticated network traffic, nor will it alert defenders to compromised credentials or malicious lateral movement. In fact, altering DHCP settings could cause IP conflicts or connectivity churn, making the investigation harder and adding unnecessary noise to an already suspicious situation.
- ✗
Block all SMB and WinRM traffic across the entire enterprise
Why it's wrong here
A blanket block of all SMB and WinRM traffic across the enterprise would be an disproportionate and operationally destructive action. SMB underpins file sharing and Group Policy updates, while WinRM is used for legitimate remote administration, so this would sever core business functions and alert the attacker to detection. The proper action is targeted containment of the affected host, followed by investigation and least-privilege network segmentation, not a global denial of service.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.