A security analyst receives an alert indicating an internal host is sending outbound traffic on TCP port 25 to multiple external IP addresses. Which action should the analyst take first to investigate potential data exfiltration?
Select one:
The trap here is that candidates often jump to containment (blocking traffic) or remediation (antivi...