SY0-701 Security Operations Practice Question
A user reports that their laptop is suddenly encrypting files and showing a ransom note. What should the incident response team do first?
⚠ Common exam trap
Candidates often confuse incident response phases and choose a recovery action (like restoring from backup) before containment, or they may mistakenly think applying updates is a valid response to an active infection, when in fact isolation is the mandatory first step per the NIST framework.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the laptop from the network to limit spread and preserve evidence.
When a laptop suddenly encrypts files and displays a ransom note, it indicates an active ransomware infection. The incident response team's first priority is to isolate the laptop from the network to prevent the ransomware from spreading laterally to other systems and to preserve volatile evidence (e.g., memory contents, running processes) that could be lost if the system is powered off or reconnected. This aligns with the NIST SP 800-61 incident response guidelines, which emphasize containment before eradication or recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately restore the laptop from backup before collecting any information.
Why it's wrong here
Restoring from backup before any investigation destroys volatile evidence such as memory artifacts, running processes, and command-line arguments that are critical for identifying the ransomware variant and its entry vector. Without forensic preservation, you may also restore a backup that contains the same vulnerability or even a dormant version of the malware, allowing re-infection. Proper incident response mandates containment and evidence collection first, then a controlled recovery that validates the backup is clean.
- ✓
Isolate the laptop from the network to limit spread and preserve evidence.
Why this is correct
Isolation is the critical containment step in an active ransomware outbreak: by disconnecting the laptop from the network (unplugging Ethernet, disabling Wi-Fi and Bluetooth), you stop the malware from encrypting any networked file shares or hopping to adjacent hosts via SMB or other propagation mechanisms. This action also preserves the system's live state so that forensic tools can capture memory, running processes, and encryption artifacts without the device being either further contaminated or remotely meddled with by the attacker. Containment must happen before eradication and recovery, per NIST IR lifecycle.
- ✗
Return the laptop to the user and monitor for additional alerts.
Why it's wrong here
Returning the laptop to the user while merely monitoring allows the ransomware to continue its encryption job and pivot to any accessible network shares, mapped drives, or connected cloud sync folders, rapidly expanding the blast radius. Monitoring alone is passive and does not stop the encryption process, nor does it protect the forensic integrity of the device; in fact, continued use may overwrite or delete valuable logs and malware remnants. The user may unknowingly trigger additional malware actions or tip off the adversary by attempting to open files, so this is both a containment and an evidence preservation failure.
- ✗
Apply all pending software updates to the laptop while it remains online.
Why it's wrong here
Applying pending operating system updates while the laptop remains online does nothing to stop ransomware that is already executing in memory or on disk; the malware's encryption routines are independent of OS patch levels and will continue to run. Moreover, keeping the device connected to the network during patching gives the ransomware more time to spread laterally and potentially exfiltrate sensitive data, while the update process itself may interfere with forensic collection by terminating malicious processes or changing system files. Patching is a preventive control for clean systems, not an immediate response to an active compromise.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.