mediumMultiple Choice
200-201 Practice Question: A security analyst is investigating an alert from…
A security analyst is investigating an alert from a host-based intrusion detection system (HIDS) that detected a file modification in the system32 directory. Which log source should the analyst check first to understand the process that made the change?
⚠ Common exam trap
Cisco often tests the distinction between host-based logs (Windows Event Logs) and network-based logs (firewall, NetFlow, DNS), expecting candidates to recognize that only host logs can reveal the process responsible for a local file change.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Windows Event Logs.
Windows Event Logs (specifically Security Event ID 4656 or 4663) record detailed information about file operations, including the process that initiated the modification. Since the HIDS detected a file change in system32, the Event Logs provide the process name, user account, and timestamp needed to trace the source of the modification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Firewall logs.
Why it's wrong here
Firewall logs record permitted and denied network connections between hosts, containing no process-level detail about which executable modified a file on the endpoint. They are tempting because they often accompany host alerts during triage; they would be the right source when tracing command-and-control traffic to an external IP address.
- ✓
Windows Event Logs.
Why this is correct
Windows Event Logs, specifically Security auditing entries such as 4663 and 4656, record the process ID and account responsible for file modifications. This gives the analyst the causal process behind the system32 change, which a HIDS alert alone does not identify.
- ✗
NetFlow data.
Why it's wrong here
NetFlow records metadata about network flows — source, destination, ports and byte counts — and cannot identify the local process that wrote to system32. It is tempting because it can reveal exfiltration or lateral movement; it would be the correct source when mapping which hosts communicated with a suspicious external address.
- ✗
DNS logs.
Why it's wrong here
DNS logs capture queried domain names and resolver responses, revealing nothing about which process on the host modified a file. They are tempting because malware often resolves command-and-control domains; they would be the right source when investigating domain-generation-algorithm activity or identifying a malicious resolved hostname.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.