A security analyst is reviewing application logs and notices a spike in outbound communication from an internal application server that usually communicates only within its subnet. What is the MOST appropriate initial action the analyst should take?
Investigate the source and destination details of the outbound communication.
Disable the server to prevent further communication.
Ignore the spike as it is a normal fluctuation.
Block outbound traffic from the server.