SY0-701 Question 133
Single answerIsolationA security administrator detects ransomware-like behavior on an employee workstation in the accounting department. The endpoint is actively attempting to connect to multiple internal file shares, but the company still needs the user to remain reachable by the IT team for remote investigation. Which action is the BEST immediate containment step?
- A
Move the workstation into a quarantine VLAN or NAC isolation network that only permits communication with approved remediation systems
- B
Shut down the organization’s core switch to stop any possible lateral movement from the infected workstation
- C
Disable all user accounts in the accounting department until the source of the activity is confirmed
- D
Reimage the workstation immediately before collecting any additional information
Show answer and explanation
Correct answer: A
Explanation
The key concept is isolation as an immediate containment control. In a real incident, security teams often place a suspected compromised host into a restricted network segment, quarantine VLAN, or NAC-controlled remediation zone. This approach prevents or limits lateral movement while preserving limited connectivity for management, EDR telemetry, patching, or forensic collection. It is more precise and operationally sound than broad shutdowns or account-wide lockouts. Security+ objectives commonly test the distinction between containment, eradication, and recovery: isolation is a containment action, while reimaging is typically part of eradication/recovery. This approach is consistent with common incident response guidance such as NIST SP 800-61, which emphasizes containment strategies that limit damage while maintaining the ability to investigate and remediate.
- A. Correct.
Correct. Isolating the affected endpoint in a quarantine VLAN or network access control (NAC) remediation network is a standard containment technique. It limits the host’s ability to reach internal resources and spread malware while still allowing controlled access for IT, EDR, or forensic tools. This aligns with incident response best practices for containment and supports the requirement that the user remain reachable by the IT team.
- B. Incorrect.
Incorrect. Shutting down the core switch is far too disruptive and would create a self-inflicted denial of service across the environment. Although it would reduce network connectivity, it is not a targeted isolation measure and is not an appropriate immediate containment step for a single suspected infected workstation.
- C. Incorrect.
Incorrect. Disabling all accounting user accounts is an overbroad identity-focused response that does not directly isolate the compromised endpoint from the network. It may interrupt business operations without preventing malware on the host from attempting local or cached actions. A candidate might choose this if they confuse account control with host/network isolation.
- D. Incorrect.
Incorrect. Reimaging may eventually be necessary, but doing so immediately skips proper containment and can destroy volatile evidence that would help confirm scope, identify the malware behavior, and determine whether lateral movement occurred. Best practice is to contain first, then investigate and eradicate according to the incident response process.