What Is the First Step When Detecting an Encrypted Outbound Connection?
A security analyst detects an encrypted outbound connection from a web server to an unknown IP address. The connection is persistent and occurs every 5 minutes. What is the MOST appropriate first step for the analyst to take?
Quick Answer
The correct first step when detecting an encrypted outbound connection is to review the server's process list and logs to identify the source. This is because an encrypted tunnel obscures the payload, so you cannot determine the connection’s intent by inspecting the traffic alone; instead, you must trace it back to the initiating process—whether a legitimate service like a scheduled backup or a malicious beacon from implanted malware. On the Security+ SY0-701 exam, this question tests the Incident Response process, specifically the Identification phase, where gathering evidence precedes containment. A common trap is jumping to block the IP or disconnect the server, which could disrupt business operations or tip off an attacker. Remember the mnemonic “PIC” for Process, Identify, Contain—always check the process list before taking action.
⚠ Common exam trap
The trap here is that candidates often jump to containment (disconnect or block) without first performing local analysis, failing to recognize that the initial step in incident response is always identification and scoping before containment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the server's process list and logs to identify the source.
The first step in investigating an unknown encrypted outbound connection is to identify the process or service responsible for initiating it. Reviewing the server's process list and logs allows the analyst to determine whether the connection is legitimate (e.g., a scheduled update or backup) or malicious (e.g., a beacon from implanted malware). Without this visibility, actions like blocking or disconnecting could disrupt legitimate services or alert an attacker prematurely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disconnect the server from the network immediately.
Why it's wrong here
While isolating a compromised system is sometimes necessary, doing so immediately without investigation may destroy volatile forensic evidence, disrupt legitimate services, and prevent understanding of the attacker's methods. Disconnection should be considered only after initial analysis indicates a clear threat.
When this WOULD be correct
If the encrypted outbound connection is confirmed as active data exfiltration of sensitive data and the server is isolated from critical systems, immediate disconnection may be justified to prevent further data loss, especially when containment is prioritized over forensic preservation.
- ✗
Block the IP address at the perimeter firewall.
Why it's wrong here
Blocking the IP address addresses the symptom but not the root cause. The malware or process causing the connection remains active on the server, and the attacker may simply switch to a different IP. This step is premature without knowing what is causing the connection.
When this WOULD be correct
This option would be correct if the question stated that the analyst has already confirmed the connection is malicious (e.g., via threat intelligence or sandbox analysis) and the immediate priority is to contain the threat by blocking communication with a known command-and-control server.
- ✓
Review the server's process list and logs to identify the source.
Why this is correct
This is the correct first step. By examining the process list and logs (e.g., system, firewall, and application logs), the analyst can determine the specific process or service responsible for the outbound connection, assess whether it is malicious, and gather evidence for further investigation or escalation.
- ✗
Escalate the incident to the incident response team.
Why it's wrong here
Escalation is appropriate once the analyst has performed initial triage and can provide the incident response team with specific findings, such as the process causing the connection and relevant log entries. Immediate escalation without investigation may delay resolution and lack necessary context.
When this WOULD be correct
This would be correct if the analyst had already identified malicious activity (e.g., confirmed malware or data exfiltration) and the incident exceeded their authority or required specialized response resources.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Review the server's process list and logs to identify the source.Correct answer▾
Why this is correct
This is the correct first step. By examining the process list and logs (e.g., system, firewall, and application logs), the analyst can determine the specific process or service responsible for the outbound connection, assess whether it is malicious, and gather evidence for further investigation or escalation.
✗Disconnect the server from the network immediately.Wrong answer — click to see why▾
Why this is wrong here
Disconnecting the server immediately could destroy volatile evidence (e.g., running processes, memory contents) needed to identify the source of the encrypted connection, and may cause unnecessary service disruption without understanding the threat.
★ When this WOULD be the correct answer
If the encrypted outbound connection is confirmed as active data exfiltration of sensitive data and the server is isolated from critical systems, immediate disconnection may be justified to prevent further data loss, especially when containment is prioritized over forensic preservation.
Why candidates choose this
Candidates may believe that stopping the connection immediately is the safest action, not realizing that preserving evidence for analysis is typically the first step in incident response unless there is an immediate threat to life or critical data loss.
✗Block the IP address at the perimeter firewall.Wrong answer — click to see why▾
Why this is wrong here
Blocking the IP address at the perimeter firewall is premature without first identifying the source and nature of the connection. The connection could be legitimate (e.g., a scheduled update or backup), and blocking it might disrupt operations or alert an attacker without gathering evidence.
★ When this WOULD be the correct answer
This option would be correct if the question stated that the analyst has already confirmed the connection is malicious (e.g., via threat intelligence or sandbox analysis) and the immediate priority is to contain the threat by blocking communication with a known command-and-control server.
Why candidates choose this
Candidates may think blocking the IP is a quick and effective containment step, but they overlook the need for investigation first to avoid false positives and preserve forensic evidence.
✗Escalate the incident to the incident response team.Wrong answer — click to see why▾
Why this is wrong here
In this scenario, the analyst has not yet identified the source of the encrypted connection. Escalating without initial investigation would bypass necessary evidence gathering and could delay containment.
★ When this WOULD be the correct answer
This would be correct if the analyst had already identified malicious activity (e.g., confirmed malware or data exfiltration) and the incident exceeded their authority or required specialized response resources.
Why candidates choose this
Candidates may believe that any suspicious encrypted outbound connection warrants immediate escalation to incident response, overlooking the need for initial triage and evidence collection.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst observes a critical server generating unusually high outbound traffic to an external IP address that is listed on a threat intelligence feed as a known command-and-control server. The analyst suspects the server is compromised. According to standard incident response procedures, what should the analyst do NEXT?
medium- A.Reboot the server to clear any malicious processes from memory
- ✓ B.Isolate the server from the network to stop the communication
- C.Apply the latest security patches to the server
- D.Ignore the alert because the external IP might be a false positive
Why B: Isolating the server from the network immediately stops the outbound command-and-control (C2) communication, preventing data exfiltration and further compromise. This aligns with the first step in the NIST SP 800-61 incident response process—containment—before any eradication or recovery actions are taken. Rebooting or patching without isolation could destroy volatile evidence (e.g., memory-resident malware) and allow the attacker to persist or escalate.
Variation 2. A security analyst at a financial firm detects an unusual spike in outbound network traffic from a database server that normally only communicates with internal web servers. The traffic is directed to numerous external IP addresses in various countries. According to established incident response procedures, what should be the analyst's immediate next step?
medium- ✓ A.Disconnect the server from the network at the switch level.
- B.Run a comprehensive antivirus scan on the server.
- C.Notify the Chief Information Security Officer (CISO) of the incident.
- D.Power off the server to prevent further damage.
Why A: Disconnecting the server at the switch level (e.g., shutting down the switch port or placing it in a quarantine VLAN) is the immediate containment step per incident response procedures. This stops the outbound data exfiltration without risking data loss or corruption that could occur from a hard power-off, and it preserves volatile memory evidence for forensic analysis.
Variation 3. A security analyst detects repeated outbound traffic from a single workstation to an IP address listed on a public threat intelligence feed as a known command-and-control server. The user reports that the workstation is behaving slowly and that antivirus software is up to date. According to incident response best practices, what should the analyst do FIRST?
medium- ✓ A.Disconnect the workstation from the network
- B.Run a full antivirus scan on the workstation
- C.Notify the user that their workstation may be compromised
- D.Check the firewall logs to confirm the destination IP
Why A: The correct first step is to disconnect the workstation from the network to immediately contain the threat and prevent further command-and-control (C2) communication. Since the traffic is already confirmed to a known C2 server via a public threat intelligence feed, the priority is to stop data exfiltration and potential lateral movement, not to gather more evidence or notify the user. Incident response best practices emphasize containment before eradication or notification to minimize damage.
Variation 4. A security analyst detects unusual outbound traffic from a workstation to an external IP address known for command and control. The analyst has verified the alert and wants to contain the threat. According to the NIST SP 800-61 incident response process, which of the following steps should the analyst take FIRST?
medium- ✓ A.Disconnect the workstation from the network
- B.Perform a forensic analysis of the workstation
- C.Reimage the workstation
- D.Alert the system administrator
Why A: According to NIST SP 800-61, the first step in containment during incident response is to prevent further damage by isolating the compromised system. Disconnecting the workstation from the network immediately stops the outbound command-and-control traffic, preventing data exfiltration and further compromise. This aligns with the 'containment' phase before any analysis or remediation occurs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.