SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Install endpoint protection updates on the laptop right away.

  Why it's wrong here

  Installing endpoint protection updates modifies the live system by writing new files, altering registry keys, and running update processes, all of which can overwrite or destroy volatile evidence that is critical to the investigation. It also requires network activity and may trigger the malware to change its behavior or delete its traces, reducing the chances of recovering an accurate picture of the infection. Furthermore, signature-based updates are unlikely to detect a novel or polymorphic threat and do nothing to preserve the running processes, memory contents, and network connections that are needed for analysis.

• ✓

  Capture volatile evidence such as running processes and memory contents.

  Why this is correct

  This is the best action because volatile data can disappear when the system is powered off or rebooted. Running processes, network connections, logged-on users, and memory contents may contain the strongest clues about active malware and attacker activity. Preserving this information first supports later investigation and helps responders understand what happened before they take more disruptive containment steps.

• ✗

  Delete suspicious files so the malware can no longer spread.

  Why it's wrong here

  Deleting suspicious files removes the primary physical evidence needed for static analysis (e.g., binary reverse engineering, string extraction, hash correlation) and can permanently destroy the only copy of the malware. Your action may also miss persistence mechanisms—such as registry Run keys, scheduled tasks, services, or WMI subscriptions—so the malware could re-infect the host immediately after the deletion. Additionally, in a live system, deleting files alters file system metadata (timestamps, journal entries) and could trigger the malware's anti-forensics routines that erase logs or corrupt other artifacts, making the overall incident analysis less complete and less defensible.

• ✗

  Reboot the laptop immediately to clear the suspected malware.

  Why it's wrong here

  Rebooting the laptop forcibly terminates all running processes and clears volatile memory (RAM), which is often the richest source of evidence about active malware, including injected code, decrypted payloads, and command-and-control communication details. This action also drops live network connections, loses the contents of temporary files and open handles, and may trigger the malware's persistence or cleanup routines to execute during shutdown—all of which can destroy evidence that would otherwise be captured. Rebooting should be postponed until after memory and other volatile data have been collected; otherwise, the investigator permanently loses the most time-sensitive artifacts, making it much harder to determine the scope and impact of the incident.

Go deeper

Related to this question