easyMultiple ChoiceObjective-mapped
200-201 Practice Question: A financial firm uses Sysmon for endpoint…
A financial firm uses Sysmon for endpoint monitoring on all Windows servers. One server, 'FIN-SRV-01', which hosts a critical database application, is exhibiting high CPU usage and unusual outbound network connections to a known malicious IP on port 8080. The Sysmon logs show Event ID 1 (Process Create) with a suspicious process 'rundll32.exe' spawned from 'winword.exe', and Event ID 3 (Network Connect) showing the connection to the malicious IP. The antivirus has not detected any threats. The analyst must decide the next immediate action to contain the threat while preserving evidence.
⚠ Common exam trap
Cisco often tests the principle that containment must preserve evidence, and the trap here is that candidates may choose a destructive action like rebooting or formatting, mistakenly thinking it removes the threat, when in fact it destroys the forensic data needed to understand the attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the server by disconnecting its network cable and taking a memory dump for further analysis.
Isolating the server by disconnecting its network cable immediately stops the outbound communication to the malicious IP on port 8080, containing the threat without destroying volatile evidence. Taking a memory dump preserves the running processes, including the suspicious rundll32.exe spawned from winword.exe, which is critical for forensic analysis of the attack chain. This approach aligns with incident response best practices: contain first, then analyze, while avoiding actions that could destroy evidence or alert the attacker.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reboot the server to clear any suspicious processes from memory.
Why it's wrong here
May lose volatile evidence and not remove persistence.
- ✗
Immediately format the server's hard drive and reinstall the OS.
Why it's wrong here
Destroys all evidence and does not allow analysis.
- ✗
Restore the server from the most recent backup taken yesterday.
Why it's wrong here
Could restore the same infected files if the backup is compromised.
- ✓
Isolate the server by disconnecting its network cable and taking a memory dump for further analysis.
Why this is correct
Preserves evidence and stops malicious activity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.