mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A security operations center (SOC) analyst…
A security operations center (SOC) analyst notices unusual outbound network traffic from a server that typically only receives connections. The traffic is encrypted and goes to an unknown external IP. Which step should the analyst perform FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the server's running processes and connections
The first step when encountering suspicious outbound traffic is to investigate without disrupting potential evidence. Checking the server's running processes and open connections (Option A) allows the analyst to identify the source process or compromised service generating the traffic. This preserves volatile data and informs subsequent containment decisions. Powering off the server (B) or blocking traffic (C) prematurely may destroy evidence and hinder root cause analysis. Notifying the system owner (D) is important but should occur after initial investigation to provide accurate information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check the server's running processes and connections
Why this is correct
Local investigation helps confirm compromise.
- ✗
Power off the server
Why it's wrong here
Powering off may destroy volatile evidence.
- ✗
Block the outbound traffic at the firewall
Why it's wrong here
Blocking may disrupt legitimate services if not confirmed.
- ✗
Notify the system owner
Why it's wrong here
Notification is important but not the first technical step.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Security operations center
A Security Operations Center (SOC) is a centralized team and facility that monitors, detects, analyzes, and responds to cybersecurity incidents across an organization's IT environment 24/7.
Key term
SOC
A Security Operations Center (SOC) is a centralized team that monitors, detects, analyzes, and responds to cybersecurity incidents to protect an organization's information systems.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.