mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: A SOC analyst is monitoring network traffic and…
A SOC analyst is monitoring network traffic and notices a large amount of data being transferred from the HR file server to an external IP address during off-hours. The server is supposed to be used only during business hours. The analyst checks the server logs and sees that a user account named 'backup_service' has been active and copying files. The 'backup_service' account is a service account that is normally used for automated backups, but the backup schedule is set to run at midnight, and the current time is 3 AM. The analyst suspects credential theft. Which of the following should the analyst do first?
⚠ Common exam trap
Cisco often tests the principle of 'preservation of evidence' where candidates mistakenly choose immediate containment actions (disable account, take offline, block IP) instead of the forensic first step of capturing volatile data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture a memory dump of the server for forensic analysis.
Capturing a memory dump preserves volatile evidence (e.g., running processes, network connections, and in-memory credentials) that is critical for forensic analysis of a suspected credential theft incident. This aligns with the NIST SP 800-86 forensic process, where memory acquisition is prioritized before any system shutdown or network changes to avoid losing evidence of the attacker's active session or malicious code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Capture a memory dump of the server for forensic analysis.
Why this is correct
A memory dump preserves evidence of the attacker's current activities, which is crucial for understanding the attack.
- ✗
Disable the 'backup_service' account immediately.
Why it's wrong here
Disabling the account may stop the activity but could also destroy evidence if the attacker has other access.
- ✗
Take the HR file server offline.
Why it's wrong here
Taking the server offline stops the exfiltration but loses volatile evidence like running processes.
- ✗
Block the external IP address at the firewall.
Why it's wrong here
Blocking the IP stops the current exfiltration but does not preserve evidence or address the compromised account.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.