mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: A security analyst notices unusual outbound…
A security analyst notices unusual outbound traffic from a server in the DMZ to an external IP address on port 4444. The server runs a web application. Which action should the analyst take first?
⚠ Common exam trap
Test-takers frequently choose to immediately block or disconnect, confusing containment with the first step of incident response, which must always be evidence preservation and scoping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the server's running processes and established connections.
The first step in incident response is to gather forensic evidence and understand the scope of the compromise. Checking running processes and established connections allows the analyst to identify the malicious process, its parent, and the active command-and-control (C2) channel on port 4444, which is commonly associated with reverse shells or backdoor traffic. This data is volatile and must be captured before any disruptive action like disconnection or reboot, which would destroy evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disconnect the server from the network.
Why it's wrong here
Disconnecting may be necessary later, but first gather information to understand the threat.
- ✗
Reboot the server to clear any malware.
Why it's wrong here
Rebooting may destroy volatile evidence needed for forensic analysis.
- ✓
Check the server's running processes and established connections.
Why this is correct
This provides immediate visibility into potential compromise without destroying evidence.
- ✗
Block the outbound traffic at the firewall.
Why it's wrong here
Blocking without investigation may hide evidence and disrupt monitoring.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.