hardMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A security analyst reviews firewall logs and…
A security analyst reviews firewall logs and notices a large number of outbound connections from a single internal IP to a known malicious IP on port 445. The analyst quarantines the workstation and runs an antivirus scan, which finds no malware. What should the analyst do next?
⚠ Common exam trap
ISC2 often tests the misconception that a clean antivirus scan means the system is secure, when in reality, fileless malware or living-off-the-land binaries (LOLBins) can evade traditional scans and require network-level forensics to detect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Analyze network traffic to identify the process responsible for the connections.
The absence of malware detection does not rule out malicious activity; the connections could be caused by a legitimate process that has been abused (e.g., a vulnerable service or script) or by fileless malware that evades signature-based scans. Analyzing network traffic with tools like Wireshark or NetFlow can identify the source process (e.g., via Windows Event Logs or Sysmon), the exact data being sent, and whether the traffic is encrypted or uses SMB protocol specifics on port 445. This forensic step is essential before taking irreversible actions like reimaging or broad blocking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conclude that the scan is clean and remove the quarantine.
Why it's wrong here
Clean scan does not guarantee safety; false negatives are possible.
- ✗
Reimage the workstation immediately.
Why it's wrong here
Reimaging may be unnecessary if malware is not confirmed.
- ✗
Block all outbound traffic on port 445 from the internal network.
Why it's wrong here
Blocking port 445 broadly could affect legitimate SMB traffic.
- ✓
Analyze network traffic to identify the process responsible for the connections.
Why this is correct
Further investigation helps identify the root cause.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Detection
Detection is the process of identifying potential security incidents or anomalies by analyzing system data, logs, and network traffic.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.