hardMultiple Choice
ISC2 CC Practice Question: A security analyst reviews firewall logs and sees…
A security analyst reviews firewall logs and sees a series of outbound connections from an internal server to a known command-and-control (C2) IP address at regular intervals. Which step should the analyst take first according to incident response best practices?
⚠ Common exam trap
CC often tests the order of incident response steps, and candidates might jump to containment (isolation) first, but the correct first step is always verification and analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check if the IP address is associated with known malware or threats.
According to incident response best practices, the first step after detecting a potential incident is to verify and validate the alert by checking if the IP is associated with known threats. This confirms whether it is a true positive before taking disruptive actions. Isolation, quarantine, and blocking are subsequent steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Isolate the server from the network immediately.
Why it's wrong here
Should be done after confirmation to avoid unnecessary disruption.
- ✓
Check if the IP address is associated with known malware or threats.
Why this is correct
Checking the IP address against current threat intelligence feeds is the crucial first step. While the IP is identified as 'known command-and-control', verifying its specific associations with malware families or active campaigns provides essential context. This enrichment confirms the nature of the threat and informs subsequent incident response phases, satisfying the need for initial validation before proceeding with containment or eradication.
- ✗
Quarantine the server and begin forensic analysis.
Why it's wrong here
Quarantining and starting forensics skips the identification and scoping phase, and quarantine can destroy volatile evidence before the C2 channel is understood. It would be the right step once the incident is confirmed and containment is required, but not as the first action on log evidence alone.
- ✗
Terminate the outbound connections by blocking the IP.
Why it's wrong here
Blocking the IP is containment, which comes after identification and scoping; acting first destroys evidence and may tip off the attacker before the extent of compromise is known. It is tempting because containment feels urgent, and blocking a known C2 address would be right once the incident is confirmed and documented.
Go deeper
Related to this question
Learn chapter
Incident Response and Management
Key term
Quarantine
Quarantine is a security process that isolates a potentially malicious file, email, or device from the rest of the system to prevent harm while it is analyzed or remediated.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.