200-201 Host-Based Analysis Practice Question
A SOC analyst receives an alert about a Windows workstation that may be infected with malware. The analyst wants to examine the system's boot configuration to determine if the malware modified boot settings to disable driver signature enforcement. Which Windows tool should the analyst use to view the current boot configuration data?
⚠ Common exam trap
Test-takers frequently confuse general system configuration tools like msconfig with the specific utility that manages boot configuration data, bcdedit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
bcdedit
The correct tool is bcdedit, which manages Windows Boot Configuration Data. Malware often modifies BCD settings such as nointegritychecks or testsigning to bypass driver signature enforcement and load malicious drivers. Inspecting BCD with bcdedit /enum reveals these modifications. Other tools like msconfig, regedit, or sigverif do not provide direct access to BCD settings, making them unsuitable for this task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
regedit
Why it's wrong here
regedit allows editing the Windows Registry, which contains many configuration settings, but boot configuration data is stored in the BCD store, not the registry. While some boot-related registry keys exist, the authoritative source for driver signature enforcement settings is the BCD. Therefore, regedit would not directly reveal the current boot configuration.
- ✗
msconfig
Why it's wrong here
msconfig is a system configuration utility for managing startup services and boot options, but it does not expose low-level BCD settings like nointegritychecks or testsigning. It provides a GUI for safe boot and startup selection, but for detailed boot configuration data, bcdedit is required. Thus, msconfig would not show whether driver signature enforcement is disabled.
- ✗
sigverif
Why it's wrong here
sigverif is a tool that scans for unsigned drivers on the system, but it does not display or modify boot configuration data. It can help identify unsigned drivers, but it does not show whether the boot configuration has been altered to disable driver signature enforcement. To view boot settings, bcdedit is the appropriate tool.
- ✓
bcdedit
Why this is correct
bcdedit is the correct tool to view and modify Windows Boot Configuration Data (BCD). It displays settings such as nointegritychecks and testsigning, which, if enabled, disable driver signature enforcement. An analyst can run 'bcdedit /enum' to inspect these values and determine if malware altered boot settings to load unsigned drivers.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.