A laptop is suspected of being used in a malware incident. It is still powered on and connected to Wi-Fi. What should the responder do before shutting it down?

Install endpoint protection updates on the laptop right away.

Updating software changes the system state and can destroy useful evidence from the active incident.

Delete suspicious files so the malware can no longer spread.

Deleting files can destroy evidence and may not remove all persistence mechanisms.

Reboot the laptop immediately to clear the suspected malware.

Rebooting can erase volatile evidence and may also trigger the malware to clean up.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Capture volatile evidence such as running processes and memory contents. — Capturing volatile evidence is the correct first step because the system is still running and connected. In incident response, responders should preserve memory, active connections, and running processes before shutdown whenever possible. Those artifacts are often lost on reboot and can be critical for understanding attacker behavior, malware presence, and lateral movement. Preservation comes before cleanup. Why others are wrong: Installing updates changes the system state and may overwrite evidence. Deleting files is destructive and can eliminate the very artifacts needed for investigation. Rebooting is also risky because it clears memory and active session data, and some malware only reveals itself while the system is running. In a live incident, preservation should come before remediation.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.