A security analyst observes a critical server generating unusually high outbound traffic to an external IP address that is listed on a threat intelligence feed as a known command-and-control server. The analyst suspects the server is compromised. According to standard incident response procedures, what should the analyst do NEXT?

Reboot the server to clear any malicious processes from memory

Rebooting may destroy volatile evidence (e.g., processes, network connections) and does not address the root cause; the attacker could re-establish persistence after reboot.

Apply the latest security patches to the server

Patching addresses vulnerabilities but is a remediation step that should occur after containment and eradication. Applying patches on a compromised host may be ineffective or could even alert the attacker.

Ignore the alert because the external IP might be a false positive

Given the alert matches a known threat intelligence feed, ignoring it could result in a successful data breach. Proper analysis should confirm, but immediate action to contain is required.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Isolate the server from the network to stop the communication — In incident response, containment is a critical step after initial detection and analysis. The priority is to prevent further damage or data exfiltration. Isolating the affected server (e.g., disconnecting it from the network) stops the communication with the C2 server and limits the attacker's ability to spread. Rebooting or patching could disrupt forensic evidence and may not stop the attack. Ignoring the alert violates security policy and could lead to a larger breach.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.