mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A company's security operations center (SOC)…
A company's security operations center (SOC) receives an alert about suspicious outbound traffic from a server in the DMZ to an external IP address known for command-and-control activity. The SOC analyst reviews the logs and sees that the source port is 443 and the destination port is 8080. Which of the following actions should the analyst take FIRST?
⚠ Common exam trap
ISC2 often tests the candidate's ability to prioritize containment over notification or broad blocking, trapping those who confuse 'first action' with 'escalation' or who apply overly aggressive firewall changes without considering service impact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the server from the network and investigate further
The SOC analyst should first isolate the server from the network because the outbound traffic from a DMZ server to a known C2 IP address, using source port 443 (HTTPS) to destination port 8080 (HTTP alternate), indicates a potential compromise. Isolating the server stops the data exfiltration and prevents further C2 communication, allowing for a controlled forensic investigation without alerting the attacker. This aligns with the NIST SP 800-61 incident response process, where containment is prioritized before eradication or recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Notify the incident response team and management immediately
Why it's wrong here
Notification is important but should come after taking immediate containment actions.
- ✓
Isolate the server from the network and investigate further
Why this is correct
Isolation contains the threat and allows forensic analysis without risk of further damage.
- ✗
Block the external IP address at the firewall
Why it's wrong here
Blocking the IP is reactive and may not address the root cause; the server could still be compromised.
- ✗
Modify the firewall rule to deny all outbound traffic from the DMZ
Why it's wrong here
This could affect other legitimate services in the DMZ and should be done after analysis.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Alert
An alert is a notification that something unusual or potentially harmful has happened in a computer system or network.
Key term
Recovery
Recovery is the process of restoring systems, data, and operations after a security incident, failure, or disaster to return to normal functioning.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.