mediumMultiple Choice
SSCP Practice Question: A security analyst notices unusual outbound…
A security analyst notices unusual outbound traffic from a server in the DMZ to an external IP address on port 4444. The server runs a web application. Which action should the analyst take first?
⚠ Common exam trap
Test-takers frequently choose to immediately block or disconnect, confusing containment with the first step of incident response, which must always be evidence preservation and scoping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the server's running processes and established connections.
The first step in incident response is to gather forensic evidence and understand the scope of the compromise. Checking running processes and established connections allows the analyst to identify the malicious process, its parent, and the active command-and-control (C2) channel on port 4444, which is commonly associated with reverse shells or backdoor traffic. This data is volatile and must be captured before any disruptive action like disconnection or reboot, which would destroy evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disconnect the server from the network.
Why it's wrong here
Disconnecting destroys volatile evidence such as active connections, memory-resident malware and running processes before capture. It is the right move for active ransomware spread or confirmed data exfiltration. Here the priority is preserving evidence while scoping the incident.
- ✗
Reboot the server to clear any malware.
Why it's wrong here
Rebooting wipes memory-resident artefacts, running processes and network state, destroying the evidence needed to identify the compromise. It is a legitimate remediation step for a confirmed, isolated infection. Here it would obstruct the investigation before the traffic's nature is established.
- ✓
Check the server's running processes and established connections.
Why this is correct
Port 4444 outbound traffic suggests a reverse shell; checking running processes and established connections identifies the responsible process and command-and-control channel before blocking, preserving evidence. This satisfies the scenario's need for the first investigative step on the DMZ server.
- ✗
Block the outbound traffic at the firewall.
Why it's wrong here
Blocking at the firewall stops the traffic but also severs the command-and-control channel, tipping off the attacker and losing forensic visibility. It suits confirmed, ongoing exfiltration where containment outweighs investigation. The first action should preserve evidence and determine whether the traffic is malicious.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.