An EDR alert shows a suspicious service spawning PowerShell and beaconing to a new C2. The endpoint is still responsive and telemetry is streaming. Which action best contains and eradicates the threat while preserving evidence?

The scenario asks for containment and eradication without losing evidence, and the most valuable evidence here is volatile. A service spawning PowerShell and beaconing to command and control usually keeps injected code, decrypted configuration, C2 addresses and session keys only in memory. NIST SP 800-86 advises giving volatile data priority over non-volatile data and warns that actions on a live system alter volatile OS data. Suspending the process freezes execution without destroying its memory, a memory image then preserves those artifacts, and restoring from a known-good backup eradicates the compromise. Terminating the process and quarantining the binary stops execution but destroys the process memory, so the injected code and C2 details are lost. Blocking the C2 IP while leaving the process running only partly contains the threat, since the malware may use alternate infrastructure, and it never eradicates anything. Disabling the service, rebooting and deleting the binary wipes both memory and the on-disk artifact. On the exam, when evidence preservation appears alongside containment, capture volatile data before any action that ends the process. Operationally, network-isolate the host through EDR, suspend the process, acquire memory and hash the image, record chain of custody, and only then reimage or restore.