mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A SOC analyst receives an alert for a high number…
A SOC analyst receives an alert for a high number of outbound connections to a known malicious IP. Which action should be taken first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the affected host
The correct first action is to isolate the affected host (Option D). This prevents further data exfiltration and gives the analyst a safe environment to investigate the compromise. Blocking the IP (Option B) stops the immediate traffic but leaves the host under attacker control. Running an antivirus scan (Option C) or notifying management (Option A) are secondary steps that should occur after containment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Notify management
Why it's wrong here
While communication is crucial in incident response, notifying management is typically performed after initial containment actions have been taken. The immediate priority is to stop the bleeding and prevent further damage or data loss, which requires technical intervention first. Premature notification without concrete containment steps can cause undue panic or lead to ineffective decision-making, as the full scope and impact are not yet understood.
- ✗
Block the IP at the firewall
Why it's wrong here
Blocking an IP address at the firewall is a network-level control that can stop outbound traffic from reaching external destinations. However, this action does not address the root cause of the compromise, which is the malicious activity occurring on the internal host itself. The compromised system remains active internally, potentially continuing to spread malware, exfiltrate data via other means, or engage in lateral movement within the network, making it an insufficient first step.
- ✗
Run an antivirus scan
Why it's wrong here
Initiating an antivirus scan on a potentially compromised host without prior isolation is generally not the most effective first step. The system might still be actively communicating with command-and-control servers or spreading malware, which could interfere with the scan's effectiveness or even accelerate data exfiltration. Isolation ensures a controlled environment for subsequent forensic analysis and remediation, including thorough scanning, without risking further compromise.
- ✓
Isolate the affected host
Why this is correct
Isolating the affected host is the most critical immediate action because it directly prevents further data exfiltration and contains the threat. By disconnecting the compromised system from the network, the SOC analyst effectively cuts off the attacker's communication channels and stops the malicious outbound traffic. This containment step is paramount for limiting the scope of the incident and creating a secure environment for subsequent investigation and remediation efforts.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.