Keylogger Found in User File: First SOC Action?

SY0-701 By islever Editorial Last updated

Given an incident, apply appropriate incident response activities. Given a scenario, analyze indicators of malicious activity. Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

Short answer

B Reimage the end user’s machine to remove the keylogger that captured the Gmail credentials and typed message before considering password changes or log review.

Question

A SOC analyst establishes a remote control session on an end user’s machine and discovers the following in a file:
gmail.com[ENT] [email protected] [ENT]NoOneCanGuessThis123! [ENT]Hello Susan, it was great to see you the other day! Let’s plan a followup[BACKSPACE]follow-up meeting soon. Here is the link to register. [RTN][CTRL]c [CTRL]v [RTN]after[BACKSPACE]After you register give me a call on my cellphone.
Which of the following actions should the SOC analyst perform first?
  1. Advise the user to change passwords.
  2. Reimage the end user’s machine. Correct Answer
  3. Check the policy on personal email at work.
  4. Check host firewall logs.

Key Takeaways

The question tests whether you recognize [ENT], [BACKSPACE], and [CTRL] keystroke artifacts as keylogger output and prioritize removing the malware over rotating credentials on the compromised host.

This SY0-701 scenario shows a keylogger capture containing a Gmail address and a cleartext password; the first action should be to reimage the infected endpoint.

Common mistake: The most tempting wrong answer is A, advising the user to change passwords, because the Gmail credential is visibly exposed; however, the keylogger remains and can capture the replacement password, so the endpoint must be reimaged first.

Expert Analysis

The file is keylogger output The bracketed tokens — [ENT], [RTN], [BACKSPACE], [CTRL]c, and [CTRL]v — are not normal message text. They are keystroke events: Enter, Return, backspace, copy, and paste. The sequence gmail.com[ENT] [email protected] [ENT]NoOneCanGuessThis123! records a Gmail address and cleartext password, and the following text records a personal message. That makes the file a keylogger capture from the end user's machine, not just a document that happens to contain a password.

Trace the capture path The keylogger runs on the endpoint and intercepts keystrokes before they reach Gmail or any other application. It writes those keystrokes to a local file, where the SOC analyst found them. As long as that process remains, every new credential typed on the host can also be captured. A password change (A) protects the Gmail account only if it is performed from a clean device after the capture mechanism is removed; on the infected machine, the replacement password can be logged too.

B is the first effective action Reimaging the end user's machine (B) removes the keylogger and its persistence, stopping the collection path. In full incident response, the analyst would normally isolate the host and preserve evidence before eradication, but those choices are not offered. Among the listed actions, B is the first one that ends the active credential theft.

C and D are secondary Checking the policy on personal email at work (C) is a governance follow-up. Checking host firewall logs (D) may help scope the incident, but it is investigative and does not stop the keylogger. The comments reflect this split: one argument focuses on the exposed Gmail password and urges immediate change, while the stronger response recognizes that changing it on an infected host is ineffective until remediation. After reimaging, the user should change the password from a trusted device, particularly if it was reused for work accounts.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a stem shows keystroke artifacts such as [ENT], [BACKSPACE], or [CTRL]c, label the file as keylogger output before reading the options. Then apply incident-response priority: remove the active capture mechanism by reimaging the endpoint before rotating credentials, because a password change on an infected host can be captured again. Treat policy checks and log review as secondary actions that do not stop ongoing credential theft.

Frequently Asked Questions

Why shouldn't the analyst advise a password change before reimaging?

A keylogger on the host can capture the replacement password, so the credential remains at risk until the endpoint is remediated. The user should change the Gmail password afterward from a clean device and check for reuse.

What in the file proves it is a keylogger capture?

The bracketed [ENT], [RTN], [BACKSPACE], [CTRL]c, and [CTRL]v tokens are keystroke events, not ordinary prose. They show the file recorded the user's typing, including the Gmail address and password.

Should the SOC analyst check host firewall logs first?

No. Firewall logs can help scoping after the active infection is handled, but they do not remove the keylogger or stop ongoing credential capture. Reimaging the endpoint is the first effective action among the options.

More SY0-701 FAQ →

Discussion 19 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 19

  1. Maxihimself 👍 7 Answered B
    Just so that you all are aware, changing the password with a keylogger installed does absolutely nothing what are y'all even doing right now
  2. 1eccfc0 👍 6 Answered A
    The correct answer is A. Advise the user to change passwords. Here's why: The file contains sensitive information, including an email address and a password ("NoOneCanGuessThis123!"), along with a suspicious message that includes commands like "[CTRL]c" and "[CTRL]v" (which may indicate attempts to copy/paste content, possibly in a malicious context). The immediate concern is the password being exposed. Given that the password appears in plaintext, the first action should be to advise the user to change their password—especially since it may be associated with a critical account (e.g., Gmail) that could be used for further attacks. It’s also important to ensure that the user is aware of the potential compromise and that the password isn't being used elsewhere.
  3. Empath 👍 4 Answered B
    The SOC analyst sees a file that contains: • A personal Gmail login (username + password in plaintext). • Evidence of keystroke logging (things like [ENT], [BACKSPACE], [CTRL]c, [CTRL]v, [RTN]). This strongly suggests the endpoint is infected with a keylogger or similar malware that records and stores user keystrokes. The options: A. Advise the user to change passwords. Changing the password while the keylogger is still active is useless, since the new password would be captured immediately. ❌ B. Reimage the end user’s machine. ✅ The system is compromised. The safest and most immediate corrective action is to wipe and rebuild (reimage) the machine to remove the keylogger/malware. After that, the user can safely change credentials.
  4. nocwyn 👍 3
    It also says what should you do first? If you change your password with the keylogger installed you have accomplished nothing aside from giving them the new password too.
  5. 78834d6 👍 2 Answered A
    The file contains cleartext credentials (email and password), which may have been compromised or harvested. Before investigating further or taking broader remediation steps, the most urgent priority is to protect the account by changing the password immediately. This helps prevent further unauthorized access and limits potential damage.
Show 14 more comments
  1. Kekeee 👍 2 Answered B
    ok so its B. because Order Action Reason 1 Tell user to cease all actions Prevent more data leaks or malware behavior 2 Reimage the compromised system Remove malware/keylogger with certainty 3 Check logs (firewall, host) Trace breach, check scope, build report 4 Change passwords Only after keylogger is gone, on a clean system
  2. 319b362 👍 2 Answered B
    WOW! I’m amazed at how so many people answered this question incorrectly! If you still can’t recognize that this file is a keylogger, you probably shouldn’t be anywhere near a computer or any kind of tech.
  3. b422ce6 👍 2 Answered B
    Changing the password on an infected machine would do no good, as the password could still be leaked with a keylogger, etc. Reimaging the system FIRST would be best in this scenario.
  4. BigCGeekn 👍 1 Answered A
    The SOC analyst should advise the user to change their password first. Incident Analysis • Exposed Credentials: The captured keystroke file shows an email username ( [email protected] ) and a cleartext password (NoOneCanGuessThis123!). • Immediate Risk: The primary and most urgent vulnerability is the exposed credential set which can be used to access the user's account. • Prioritization: Mitigating active credential exposure by instructing the user to reset the compromised password takes priority over destructive or secondary actions like reimaging the machine.
  5. Clau95 👍 1 Answered B
    Answer B - To ensure the integrity of the system and prevent any further compromise, the first priority should be to reimage the end user's machine. Reimaging will remove any potential malware or unauthorized software that may be affecting the system.
  6. Bunaventi 👍 1 Answered A
    I think a) advise to change pw is better than B) reimage the end user because changing the exposed password immediately prevents unauthorized access, whereas reimaging the machine is a more drastic step that comes later after confirming a compromise.
  7. tailogdavid1987 👍 1 Answered A
    The file is a keylogger capture: email, NoOneCanGuessThis123!, and the message they typed. Those credentials are exposed, so the password change comes first. Reimaging is next.
  8. AriGarcia 👍 1 Answered A
    Although the SOC analyst should reimage the computer to get rid of the keyloger. The first thing to do is have the user change passwordl.
  9. fc040c7 👍 1 Answered A
    Keylogger present. First priority should be to tell them to change their password. Afterwards, take care of the keylogger issue.
  10. Dumbledores_Army 👍 1 Answered A
    Contain the impact first (protect credentials, change password on a known-clean system) before eradication (e.g., reimaging)
  11. nocwyn 👍 1 Answered B
    If they have a keylogger, you cant be sure what type of malware or if its just 1. You reimage the machine.
  12. cab08df 👍 1 Answered A
    A. Only because the user could use a different device to change their password that is currently exposed.
  13. Maxihimself 👍 1
    ah yes, let them have the password again because A KEYLOGGER IS INSTALLED ON THE MACHINE HELLLLOOOOOO
  14. Shakaiser 👍 1 Answered A
    Google Gemini and ChatGPT both responded A is the answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide