hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A SOC analyst receives an alert for a suspicious…
A SOC analyst receives an alert for a suspicious outbound connection from a server in the DMZ to an external IP on port 443. The server is a web application server that should only communicate internally. The analyst checks the process and finds it is 'svchost.exe' running from a non-standard path. What is the most appropriate immediate action?
⚠ Common exam trap
It's easy for candidates to think terminating the process (Option D) is sufficient, but the CISSP emphasizes containment over eradication to prevent further compromise, and they may also mistakenly trust svchost.exe as always legitimate without verifying its path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the server from the network
Isolating the server immediately contains the threat, preventing potential data exfiltration or lateral movement from a compromised host. The suspicious outbound connection from a DMZ server to an external IP on port 443 (HTTPS) combined with 'svchost.exe' running from a non-standard path strongly indicates malware masquerading as a legitimate Windows process. In security operations, containment is the priority before investigation to minimize damage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the server from the network
Why this is correct
Isolating the server from the network is the immediate and most effective containment strategy. This action severs the malicious outbound connection, preventing further data exfiltration, command-and-control communication, and potential lateral movement to other systems. By containing the threat, the analyst preserves the compromised system's state for subsequent forensic analysis, allowing for a thorough investigation without the risk of ongoing damage or evidence tampering. This critical first step minimizes the incident's overall impact.
- ✗
Initiate a full incident response investigation
Why it's wrong here
Initiating a full incident response investigation immediately, without prior containment, is premature and risky. While investigation is a crucial phase, the primary concern after detection is to limit the scope and impact of the compromise. Proceeding directly to a full investigation allows the threat to potentially spread, exfiltrate more data, or cause further damage while resources are focused on analysis rather than mitigation. Containment must always precede comprehensive investigation to prevent escalation.
- ✗
Disregard the alert because svchost.exe is a legitimate Windows process
Why it's wrong here
Disregarding the alert because svchost.exe is a legitimate Windows process demonstrates a critical misunderstanding of common malware tactics. Although svchost.exe is a core system process that hosts numerous Windows services, its legitimacy is frequently exploited by attackers through techniques like process masquerading or hollowing. The alert specifically mentioning a "non-standard path" is a strong indicator of compromise, as legitimate svchost.exe instances always run from specific, well-known system directories. This deviation warrants immediate, not disregarded, attention.
- ✗
Terminate the suspicious process
Why it's wrong here
Terminating the suspicious process alone is an insufficient and potentially counterproductive response. While it might temporarily halt the current malicious activity, sophisticated malware often employs persistence mechanisms, such as registry entries, scheduled tasks, or watchdog processes, that would simply restart the terminated process. Furthermore, abruptly killing a process without proper forensic collection could destroy volatile evidence or even trigger anti-forensic measures designed to hinder investigation, leaving the underlying compromise unaddressed.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst receives an alert for a high number of outbound connections to a known malicious IP. Which action should be taken first?
medium- A.Notify management
- B.Block the IP at the firewall
- C.Run an antivirus scan
- ✓ D.Isolate the affected host
Why D: The correct first action is to isolate the affected host (Option D). This prevents further data exfiltration and gives the analyst a safe environment to investigate the compromise. Blocking the IP (Option B) stops the immediate traffic but leaves the host under attacker control. Running an antivirus scan (Option C) or notifying management (Option A) are secondary steps that should occur after containment.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.