A security analyst notices a sudden increase in outbound traffic from a database server that normally only communicates with internal application servers. The server is running a standard OS with no recent changes. Which of the following actions should the analyst take FIRST to determine if the server is compromised?

Run a full antivirus scan on the server.

Antivirus scans rely on signature databases and may miss custom or zero-day malware, and they can be time-consuming, delaying a timely response. This is not the best first step.

Block all outbound traffic from the server at the firewall.

Blocking traffic may contain the threat but also destroys evidence of the communication pattern and could alert an attacker prematurely. Investigation should precede containment.

Review the server's event logs for failed login attempts.

While event logs can show unauthorized access attempts, they do not directly address the current anomalous outbound traffic. This is a secondary analysis step, not the first action.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Check the server's running processes for unknown executables. — When investigating potential compromise indicated by unusual outbound traffic, the first priority is to gather immediate evidence of malicious activity on the host. Checking running processes can quickly reveal unauthorized or suspicious executables that may be conducting data exfiltration or communicating with command-and-control servers. This step is non-intrusive and provides a direct indicator of compromise.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.