mediumMultiple ChoiceObjective-mapped
Incident Response for Host-Based Analysis: Step-by-Step Guide
A company uses Microsoft Windows Event Logging for host monitoring. The security team receives an alert from a Windows 10 workstation 'WS-102' indicating multiple failed logon attempts (Event ID 4625) within a short period from an internal IP address 10.10.10.50, followed by a successful logon (Event ID 4624) for user 'jdoe'. Shortly after, Event ID 4688 (Process Creation) shows 'cmd.exe' started by 'explorer.exe' with a command line launching 'powershell.exe -EncodedCommand ...'. The encoded command decodes to a script that attempts to download a payload from a remote server. The analyst needs to determine the most effective immediate response to limit lateral movement and impact.
Quick Answer
The correct immediate response is to reset the password for user 'jdoe', block outbound traffic to the remote server at the firewall, and initiate the incident response process. This combination is critical because the sequence of events—brute-force logon attempts followed by a successful logon and an encoded PowerShell command attempting a payload download—confirms a host compromise where the attacker has gained authenticated access. Resetting the password immediately cuts off the attacker's lateral movement by revoking their credentials, while blocking outbound traffic prevents the payload download and command-and-control communication, effectively containing the breach. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your ability to prioritize containment actions during incident response after host compromise, often appearing as a multi-step question where traps include focusing only on isolating the host or analyzing logs without taking action. A common memory tip is "Credentials, C2, Contain": reset credentials first, block C2 traffic second, then initiate formal containment procedures.
⚠ Common exam trap
Cisco often tests the distinction between reactive steps (like scanning or disabling accounts) and proactive containment actions that immediately cut off the attacker's access and communication channels, leading candidates to choose a less effective response that does not address both credential compromise and network egress.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Immediately reset the password for user 'jdoe', block outbound traffic to the remote server at the firewall, and initiate an incident response process.
The sequence of events—brute-force logon attempts followed by a successful logon and then an encoded PowerShell command attempting to download a payload—indicates a confirmed compromise. Resetting the password for 'jdoe' immediately revokes the attacker's authenticated access, blocking outbound traffic to the remote server prevents the payload download and C2 communication, and initiating incident response ensures proper containment and investigation. This combination directly limits lateral movement by cutting off the attacker's credentials and network egress.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restore WS-102 from a known good backup and ignore the alert as a false positive.
Why it's wrong here
Ignoring could lead to further compromise.
- ✓
Immediately reset the password for user 'jdoe', block outbound traffic to the remote server at the firewall, and initiate an incident response process.
Why this is correct
Resets credentials, stops C2 communication, and begins formal response.
- ✗
Run a full antivirus scan on WS-102 and isolate it.
Why it's wrong here
Antivirus may not detect all threats and isolation alone may not stop lateral movement.
- ✗
Disable the user account 'jdoe' and investigate the source IP 10.10.10.50.
Why it's wrong here
Disabling the account without resetting may allow password reuse.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst is investigating a suspicious file on a Windows host. The file hash matches a known malware variant in a threat intelligence feed. What is the next best step for host-based analysis?
easy- A.Run a full antivirus scan on the host
- B.Disable the network adapter to prevent further communication
- ✓ C.Check for persistence mechanisms such as registry Run keys or scheduled tasks
- D.Reboot the host to clear the malware from memory
Why C: After confirming a file hash matches a known malware variant, the immediate priority for host-based analysis is to determine how the malware maintains persistence on the system. Persistence mechanisms such as Registry Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) or scheduled tasks (via schtasks.exe) allow malware to survive reboots and re-establish execution. Identifying these artifacts is critical for containment and eradication, as it reveals the malware's foothold and prevents re-infection after removal.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.