Q83
Single choice
A security is responding to an incident on a web server on the company network that is making a large number of outbound requests over DNS.
Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of compromise?