CompTIA CySA+ CS0-003 Practice Question

The most appropriate initial action is to investigate the source and destination details of this unexpected outbound communication. This can help identify whether the spike is due to a legitimate change in behavior (such as a new feature or update) or potentially malicious activity (like data exfiltration). Blocking traffic or disabling the server might be too disruptive without concrete evidence that the activity is malicious. Ignoring the spike might overlook a potential threat.