SY0-701 Question 384
Single answer4.8 Explain appropriate incident response activities.A security analyst discovers that a finance department workstation is communicating with a known command-and-control IP address and is attempting to upload large encrypted archives. The user reports that several files were renamed overnight and can no longer be opened. The analyst has confirmed the host is likely infected with ransomware, but the system contains volatile evidence that may help identify patient zero and the initial attack vector. Which action should the incident response team take NEXT?
- A
Immediately reimage the workstation to restore business operations and prevent further encryption
- B
Isolate the workstation from the network and capture volatile memory and relevant live response data before powering it down
- C
Shut down the workstation immediately to stop the malware process and preserve the disk in its current state
- D
Notify law enforcement first and wait for external guidance before making any changes to the workstation
Show answer and explanation
Correct answer: B
Explanation
The key incident response activity being tested is selecting the most appropriate next step during containment while preserving evidence. In this scenario, the team has a confirmed compromise, signs of active exfiltration, and a clear need to retain volatile data. Best practice is to isolate the affected system from the network to limit spread and outbound communications, then collect volatile evidence such as memory contents, active processes, logged-in users, network sessions, and running services before shutdown or reimaging. This sequence supports later investigation, root-cause analysis, and potential legal or regulatory actions. This approach is consistent with common incident response guidance such as NIST SP 800-61 Computer Security Incident Handling Guide, which emphasizes containment strategies, evidence preservation, and careful sequencing of eradication and recovery actions.
- A. Incorrect.
This is incorrect because immediately reimaging destroys valuable forensic evidence, especially volatile artifacts such as running processes, network connections, encryption keys in memory, and attacker tools. Reimaging may be appropriate later during recovery, but it is not the best next step when the team already knows the host is compromised and wants to preserve evidence while containing the threat.
- B. Correct.
This is correct because the best immediate action balances containment with evidence preservation. Isolating the host helps prevent additional lateral movement, data exfiltration, or command-and-control traffic. Capturing volatile memory and live response data before shutdown preserves ephemeral evidence that would be lost if power is removed. This aligns with standard incident response practice: contain the incident, preserve evidence, and collect data in a forensically sound manner before eradication and recovery.
- C. Incorrect.
This is incorrect because although shutting down can stop ongoing malicious activity, it also destroys volatile evidence in RAM. Since the scenario specifically states that volatile evidence may help identify patient zero and the initial attack vector, an immediate shutdown would undermine the investigation. Analysts may choose shutdown in some situations, but here evidence preservation is a key requirement.
- D. Incorrect.
This is incorrect because law enforcement notification may be appropriate depending on organizational policy, regulatory requirements, and incident severity, but it is not the best next operational step. The team should first contain the system and preserve evidence according to the incident response plan. Waiting for outside guidance before taking basic containment measures could allow the incident to worsen.