mediumMultiple Choice
ISC2 CC Practice Question: A security operations center (SOC) analyst…
A security operations center (SOC) analyst notices unusual outbound network traffic from a server that typically only receives connections. The traffic is encrypted and goes to an unknown external IP. Which step should the analyst perform FIRST?
⚠ Common exam trap
CC often tests the order of incident response steps; candidates may choose containment actions like blocking or powering off because they seem urgent, but the first step is always to identify and understand the incident without destroying evidence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the server's running processes and connections
The first step in incident response is to gather evidence and understand the scope without altering the system. Checking the server's running processes and connections (A) allows the analyst to identify the malicious process, its parent, and the remote endpoint, which informs containment and eradication. This aligns with the 'identification' phase of incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check the server's running processes and connections
Why this is correct
Checking running processes and active connections identifies which executable is generating the encrypted outbound traffic and where it is connecting, providing the host-level evidence needed before any containment or blocking. This triage step satisfies the requirement to determine what is actually happening on the server first.
- ✗
Power off the server
Why it's wrong here
Powering off the server destroys volatile evidence such as memory-resident malware, running processes and network connections needed for investigation. It is tempting as immediate containment, but isolation preserves forensic artefacts while stopping the traffic; powering off is a last resort after evidence capture.
- ✗
Block the outbound traffic at the firewall
Why it's wrong here
Blocking traffic destroys volatile evidence before the source and payload are identified, and the server may be a pivot for lateral movement. Firewall blocking is a containment action taken after triage. The analyst should first isolate or capture the traffic to scope the incident.
- ✗
Notify the system owner
Why it's wrong here
Notifying the system owner delays containment while encrypted command-and-control traffic continues exfiltrating data. It is tempting because owners can confirm whether traffic is legitimate, but that validation suits a later verification stage; the analyst should first isolate the host to stop the activity.
Go deeper
Related to this question
Learn chapter
Wireless and Remote Access Security
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.