Question 88 of 1,013
How to Contain a Workstation Communicating with a Known Malicious IP Address
A security analyst receives an alert that a user's workstation is communicating with a known malicious IP address during off-hours. The analyst reviews the firewall logs and confirms the connection was established. Which of the following should the analyst perform NEXT to contain the threat?
Quick Answer
The answer is to isolate the workstation from the network. This is the correct containment step because it immediately severs the active connection to the known malicious IP address, stopping any ongoing data exfiltration, lateral movement, or command-and-control (C2) traffic. In the Security+ SY0-701 exam, this scenario tests your understanding of the NIST incident response framework’s containment phase, which prioritizes halting the threat before investigation or remediation. A common trap is choosing to disable the user account, but that fails if the malware runs as a service or uses cached credentials; similarly, running a scan or notifying management are post-containment actions. For the exam, remember the memory tip: “Cut the cord, not the account” — always stop the network-level communication first when a workstation is talking to a malicious IP off-hours.
⚠ Common exam trap
CompTIA often tests the distinction between containment and remediation, trapping candidates who choose to run an antivirus scan (Option C) first, when the correct incident response order is to isolate the host to stop the active threat before any scanning or notification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation from the network.
Isolating the workstation from the network (Option B) is the immediate containment step because it stops the active communication with the known malicious IP address, preventing further data exfiltration, lateral movement, or command-and-control (C2) activity. This aligns with the NIST incident response framework's containment phase, which prioritizes stopping the threat before investigation or remediation. Disabling the user account (A) does not stop the network-level communication if the malware is running as a service or using cached credentials, and running a scan (C) or notifying management (D) are post-containment actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the user's account immediately.
Why it's wrong here
Disabling the account might stop authentication-based actions, but the workstation could still communicate with the malicious IP if it uses cached credentials or non-interactive sessions. Additionally, the account may be compromised, but containment of the endpoint is more urgent.
When this WOULD be correct
If the alert indicated that the user's account credentials were compromised and being used from an unauthorized location, disabling the account would be the immediate step to prevent further unauthorized access.
- ✓
Isolate the workstation from the network.
Why this is correct
Isolating the workstation stops all network communication, including the connection to the malicious IP. This is a direct containment action that prevents further exfiltration, command-and-control activity, or lateral spread.
- ✗
Run a full antivirus scan on the workstation.
Why it's wrong here
Running a scan is a detection or remediation step, not a containment step. It may take time and could alert the attacker, allowing them to destroy evidence. Containment should happen before scanning.
When this WOULD be correct
A security analyst receives an alert that a user's workstation is exhibiting signs of malware infection (e.g., unusual file modifications). The analyst has already isolated the workstation. Which of the following should the analyst perform NEXT to determine the extent of the infection?
- ✗
Notify the user's manager of the policy violation.
Why it's wrong here
Notification is an administrative step that occurs after immediate containment. It does not stop ongoing malicious activity and should not be the next action in an incident response process.
When this WOULD be correct
In a scenario where an alert indicates a policy violation (e.g., accessing prohibited websites during work hours) with no active security threat, the analyst should notify the manager for disciplinary action after confirming the violation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Isolate the workstation from the network.Correct answer▾
Why this is correct
Isolating the workstation stops all network communication, including the connection to the malicious IP. This is a direct containment action that prevents further exfiltration, command-and-control activity, or lateral spread.
✗Disable the user's account immediately.Wrong answer — click to see why▾
Why this is wrong here
Disabling the user's account does not stop the active network communication from the compromised workstation to the malicious IP; the threat remains active on the network.
★ When this WOULD be the correct answer
If the alert indicated that the user's account credentials were compromised and being used from an unauthorized location, disabling the account would be the immediate step to prevent further unauthorized access.
Why candidates choose this
Candidates may think that disabling the account is a quick way to stop malicious activity, but they overlook that the workstation itself is already compromised and still communicating externally.
✗Run a full antivirus scan on the workstation.Wrong answer — click to see why▾
Why this is wrong here
Running a full antivirus scan is a detection and remediation step, not a containment step. The immediate priority is to stop communication with the malicious IP, which isolation achieves; scanning can occur after containment.
★ When this WOULD be the correct answer
A security analyst receives an alert that a user's workstation is exhibiting signs of malware infection (e.g., unusual file modifications). The analyst has already isolated the workstation. Which of the following should the analyst perform NEXT to determine the extent of the infection?
Why candidates choose this
Candidates often think scanning is the first response to any malware indicator, confusing detection/remediation with containment, and underestimate the urgency of stopping active malicious communication.
✗Notify the user's manager of the policy violation.Wrong answer — click to see why▾
Why this is wrong here
Notifying the user's manager of a policy violation does not directly contain the threat; the workstation is still communicating with a malicious IP, and containment (e.g., isolation) is the immediate priority.
★ When this WOULD be the correct answer
In a scenario where an alert indicates a policy violation (e.g., accessing prohibited websites during work hours) with no active security threat, the analyst should notify the manager for disciplinary action after confirming the violation.
Why candidates choose this
Candidates may think that reporting the incident to management is a standard step, but they overlook that containment must occur first to prevent further damage from the active malicious connection.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of outbound traffic from a single internal workstation to an external IP address known to be associated with a command-and-control (C2) server. The workstation's user reports no unusual activity. Which of the following should the analyst do FIRST?
medium- ✓ A.Disconnect the workstation from the network.
- B.Run a full antivirus scan on the workstation.
- C.Review firewall logs to see if the traffic is being blocked.
- D.Inform the user to shut down the workstation.
Why A: The IDS alert indicates a high volume of outbound traffic to a known C2 server, which strongly suggests the workstation is compromised and communicating with an attacker. Disconnecting the workstation from the network (Option A) is the immediate containment step to prevent data exfiltration and further C2 communication, following the NIST incident response framework's containment phase. This action stops the threat at the network layer without waiting for additional analysis.
Variation 2. A security analyst receives an alert from the intrusion detection system indicating that a workstation in the finance department has established an outbound connection to a known malicious IP address using an encrypted protocol. The analyst verifies the alert and checks the user's activity logs, which show no legitimate business reason for the connection. According to the incident response process, what should the analyst do NEXT?
medium- A.Begin the eradication phase by immediately reimaging the workstation.
- ✓ B.Isolate the workstation from the network to contain the threat.
- C.Conduct a full forensic analysis of the workstation's hard drive.
- D.Update the firewall rule to block all outbound traffic to the malicious IP.
Why B: According to the NIST SP 800-61 incident response process, containment is the immediate priority after verification to prevent further damage or data exfiltration. Since the workstation has an active encrypted outbound connection to a known malicious IP with no legitimate business reason, isolating the network interface (e.g., disabling the port, blocking the MAC address, or unplugging the cable) stops the threat from communicating while preserving the system state for later analysis. This aligns with the containment phase, which must precede eradication or full forensic analysis.
Last reviewed: Jun 30, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.