hardMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A security analyst reviews firewall logs and sees…
A security analyst reviews firewall logs and sees a series of outbound connections from an internal server to a known command-and-control (C2) IP address at regular intervals. Which step should the analyst take first according to incident response best practices?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check if the IP address is associated with known malware or threats.
Per incident response best practices, the first step is to verify the alert through threat intelligence to confirm it's not a false positive. Checking if the IP address is associated with known malware or threats (option B) validates the alert before taking any disruptive actions. Immediately isolating, quarantining, or blocking (options A, C, D) without confirmation can cause unnecessary disruption if the alert is benign.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Isolate the server from the network immediately.
Why it's wrong here
Should be done after confirmation to avoid unnecessary disruption.
- ✓
Check if the IP address is associated with known malware or threats.
Why this is correct
Checking the IP address against current threat intelligence feeds is the crucial first step. While the IP is identified as 'known command-and-control', verifying its specific associations with malware families or active campaigns provides essential context. This enrichment confirms the nature of the threat and informs subsequent incident response phases, satisfying the need for initial validation before proceeding with containment or eradication.
- ✗
Quarantine the server and begin forensic analysis.
Why it's wrong here
Quarantine is a containment step that should follow verification.
- ✗
Terminate the outbound connections by blocking the IP.
Why it's wrong here
Blocking without verification may impact legitimate traffic and alert the attacker.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.