Security Operations →mediumMultiple ChoiceObjective-mapped

SY0-701 Security Operations Practice Question

A security analyst notices a sudden increase in outbound traffic from a database server that normally only communicates with internal application servers. The server is running a standard OS with no recent changes. Which of the following actions should the analyst take FIRST to determine if the server is compromised?

⚠ Common exam trap

The trap here is that candidates often jump to blocking traffic (Option C) as a quick fix, but the FIRST action must be to gather evidence by inspecting running processes, as blocking prematurely destroys forensic data and violates the principle of 'do no harm' during incident response.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Check the server's running processes for unknown executables.

Checking the server's running processes for unknown executables is the first and most direct step to identify if an attacker has established a foothold. A sudden outbound traffic spike without recent configuration changes strongly suggests a malicious process (e.g., a reverse shell or data exfiltration tool) is running. Examining running processes allows the analyst to spot suspicious executables or command-line arguments before taking more disruptive actions like blocking traffic or running a scan.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Run a full antivirus scan on the server.
Why it's wrong here
A full antivirus scan is signature-dependent and will not detect custom, polymorphic, or fileless malware that may be driving the outbound beaconing. It also consumes significant CPU and disk I/O, which degrades server performance and extends the response window. Rapid triage requires observing active processes and network connections, not waiting for a time-consuming scan that may produce a false negative.
When this WOULD be correct
A security analyst notices multiple endpoints exhibiting slow performance and pop-ups, and a recent email campaign delivered a known malware strain. Running a full antivirus scan would be the first step to identify and remove the known malware across the environment.
✓
Check the server's running processes for unknown executables.
Why this is correct
Inspecting the server's active process list is the most direct method to correlate the anomalous outbound traffic with a specific executable. Tools like `ps`, Task Manager, or `netstat -bno` can reveal a process's PID and its established remote connections, often immediately exposing an unknown or masquerading binary. This step provides high-fidelity, real-time evidence before more invasive or slower actions, making it the appropriate incident-response triage action.
✗
Block all outbound traffic from the server at the firewall.
Why it's wrong here
Immediately blocking all outbound traffic at the firewall disrupts legitimate operations and, more critically, destroys the ability to observe the attacker's command-and-control channel or data exfiltration pattern. Network flow data and connection logs that could provide attribution or IoCs are lost once the traffic stops, and the attacker may be alerted, prompting a destructive response. Containment is important, but it should follow a quick investigation to identify and selectively stop the malicious communication.
When this WOULD be correct
If the question asked for the BEST immediate action to prevent data exfiltration after confirming a compromise, blocking outbound traffic at the firewall would be correct.
✗
Review the server's event logs for failed login attempts.
Why it's wrong here
Failed login event logs are historical records that indicate authentication problems, not necessarily the cause of current outbound communication. An attacker could have legit administrative credentials or be exploiting a service without any failed logins, so this review would miss the active threat. While valuable for forensic reconstruction later, this is a slower, indirect approach that delays immediate identification of the traffic source.
When this WOULD be correct
This would be correct if the question described a scenario where the analyst suspects a brute-force attack or credential compromise, and the first step is to identify the source of unauthorized access attempts.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.

✓Check the server's running processes for unknown executables.Correct answer▾

Why this is correct

Inspecting the server's active process list is the most direct method to correlate the anomalous outbound traffic with a specific executable. Tools like `ps`, Task Manager, or `netstat -bno` can reveal a process's PID and its established remote connections, often immediately exposing an unknown or masquerading binary. This step provides high-fidelity, real-time evidence before more invasive or slower actions, making it the appropriate incident-response triage action.

✗Run a full antivirus scan on the server.Wrong answer — click to see why▾

Why this is wrong here

Running a full antivirus scan is time-consuming and may not detect sophisticated or custom malware. The immediate priority is to identify suspicious processes causing the unusual outbound traffic, which is faster and more direct.

★ When this WOULD be the correct answer

A security analyst notices multiple endpoints exhibiting slow performance and pop-ups, and a recent email campaign delivered a known malware strain. Running a full antivirus scan would be the first step to identify and remove the known malware across the environment.

Why candidates choose this

Candidates often default to antivirus scans as a standard response to potential compromise, overlooking that the immediate symptom (unusual outbound traffic) requires process investigation for a quicker assessment.

✗Block all outbound traffic from the server at the firewall.Wrong answer — click to see why▾

Why this is wrong here

Blocking all outbound traffic at the firewall would disrupt legitimate internal communications and is a reactive containment step, not a first investigative action to determine compromise.

★ When this WOULD be the correct answer

If the question asked for the BEST immediate action to prevent data exfiltration after confirming a compromise, blocking outbound traffic at the firewall would be correct.

Why candidates choose this

Candidates may think stopping suspicious traffic is the priority, but the first step is to gather evidence (processes) before taking containment actions.

✗Review the server's event logs for failed login attempts.Wrong answer — click to see why▾

Why this is wrong here

Reviewing event logs for failed login attempts is a secondary step; the immediate priority is to identify active malicious processes causing the outbound traffic spike, not historical authentication events.

★ When this WOULD be the correct answer

This would be correct if the question described a scenario where the analyst suspects a brute-force attack or credential compromise, and the first step is to identify the source of unauthorized access attempts.

Why candidates choose this

Candidates often associate compromise with unauthorized access, so they default to checking login logs, overlooking that active data exfiltration requires immediate process investigation.

Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

SY0-701 Security Operations Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question