The answer is to isolate the server from the network. This is the correct immediate action because when a host shows clear signs of compromise—such as a suspicious outbound connection from a DMZ server to an external IP on port 443, combined with svchost.exe running from a non-standard path—the priority in incident response is containment to prevent data exfiltration or lateral movement. On the CISSP exam, this scenario tests your understanding of the containment phase within the NIST incident response framework, where isolating a compromised host is the first step before any forensic analysis. A common trap is choosing to kill the process or block only the specific port, but attackers can easily spawn new processes or use alternative ports; network isolation ensures the threat is fully contained. Remember the memory tip: "Contain before you cure"—in incident response, stop the bleeding before diagnosing the wound.
CISSP Security Operations Practice Question
This CISSP practice question tests your understanding of security operations. Compare every option against the stated constraints before choosing — the best answer satisfies all requirements, not just the most obvious one. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A SOC analyst receives an alert for a suspicious outbound connection from a server in the DMZ to an external IP on port 443. The server is a web application server that should only communicate internally. The analyst checks the process and finds it is 'svchost.exe' running from a non-standard path. What is the most appropriate immediate action?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the server from the network
Option A is correct because isolating the server immediately contains the threat, preventing potential data exfiltration or lateral movement from a compromised host. The suspicious outbound connection from a DMZ server to an external IP on port 443 (HTTPS) combined with 'svchost.exe' running from a non-standard path strongly indicates malware masquerading as a legitimate Windows process. In security operations, containment is the priority before investigation to minimize damage.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Isolate the server from the network
Why this is correct
Isolation stops the malicious outbound connection and prevents further damage, allowing for later forensic analysis.
Related concept
Read the scenario before looking for a memorised answer.
✗
Initiate a full incident response investigation
Why it's wrong here
While necessary, immediate containment should precede full investigation to limit impact.
✗
Disregard the alert because svchost.exe is a legitimate Windows process
Why it's wrong here
svchost.exe is legitimate, but running from a non-standard path is a strong indicator of compromise.
✗
Terminate the suspicious process
Why it's wrong here
Terminating the process may stop the current connection, but the malware could restart or other components may remain.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think terminating the process (Option D) is sufficient, but the CISSP emphasizes containment over eradication to prevent further compromise, and they may also mistakenly trust svchost.exe as always legitimate without verifying its path.
Detailed technical explanation
How to think about this question
The svchost.exe process is a generic host process for Windows services that run from DLLs, and its legitimate path is always %SystemRoot%\System32 or %SysWOW64%; any deviation (e.g., C:\Temp\svchost.exe) is a red flag. Outbound HTTPS (port 443) from a DMZ server that should only communicate internally suggests command-and-control (C2) traffic, often using encrypted channels to evade detection. In real-world scenarios, such as the Emotet or TrickBot malware, svchost.exe masquerading is common, and immediate network isolation via ACL or disabling the switch port is the first step in the NIST SP 800-61 incident response lifecycle.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A SOC analyst notices unusual lateral movement in the network at 2 AM. The IR playbook dictates: identify and contain (isolate the affected machine), then eradicate (remove the malware), then recover (restore from backup), then document. Skipping containment before eradication risks the attacker regaining access. Questions like this test the sequence and rationale of incident response phases.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CISSP question in full detail.
Security Operations — This question tests Security Operations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Isolate the server from the network — Option A is correct because isolating the server immediately contains the threat, preventing potential data exfiltration or lateral movement from a compromised host. The suspicious outbound connection from a DMZ server to an external IP on port 443 (HTTPS) combined with 'svchost.exe' running from a non-standard path strongly indicates malware masquerading as a legitimate Windows process. In security operations, containment is the priority before investigation to minimize damage.
What should I do if I get this CISSP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst receives an alert for a high number of outbound connections to a known malicious IP. Which action should be taken first?
medium
A.Notify management
B.Block the IP at the firewall
C.Run an antivirus scan
✓ D.Isolate the affected host
Why D: Option A is correct because isolating the host prevents further data exfiltration and allows for safe investigation. Blocking the IP may stop the traffic but the host remains compromised. Antivirus and notification are secondary steps.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.