200-201 Security Concepts Practice Question
An analyst is investigating an incident and needs to determine the source of a piece of malware. The analyst finds that the malware uses a domain generation algorithm to contact command-and-control servers. Which term best describes this capability?
⚠ Common exam trap
The trap here is associating any advanced evasion technique with persistence, when the domain generation algorithm specifically supports locating and communicating with C2 infrastructure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Command and control
A domain generation algorithm creates a large set of pseudo-random domain names that malware periodically queries to find an active command-and-control server. This technique helps the malware evade static blocklists and takedown attempts, because defenders cannot easily predict or block every possible domain. The scenario states the malware contacts command-and-control servers, so the capability is command and control. Persistence, privilege escalation, and lateral movement describe different phases or objectives of an intrusion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Persistence
Why it's wrong here
Persistence refers to a malware's ability to survive reboots and remain on a system, often through registry keys, scheduled tasks, or services. A domain generation algorithm does not maintain the malware's presence on the host; it helps the malware locate its command-and-control infrastructure. While persistence is an important malware capability, it is not the term that describes dynamically generating domain names for C2 communication, so this option does not fit the scenario.
- ✓
Command and control
Why this is correct
Command and control (C2) describes the communication channel between malware and its operator. A domain generation algorithm produces many possible domain names that the malware queries to find an active C2 server, making it harder for defenders to block a single domain. The scenario explicitly mentions contacting command-and-control servers, so this capability is best described as command and control. It is the correct term for the malware's remote communication mechanism.
- ✗
Lateral movement
Why it's wrong here
Lateral movement refers to an attacker moving from one compromised system to another within a network to reach valuable assets. A domain generation algorithm is used for outbound communication with C2 servers, not for pivoting between internal hosts. The scenario does not describe the malware spreading to other systems; it describes how it locates its controller. Therefore, lateral movement is not the best term for this capability.
- ✗
Privilege escalation
Why it's wrong here
Privilege escalation is the process of gaining higher-level permissions on a system, such as moving from a standard user to administrator. The domain generation algorithm described in the scenario does not grant elevated access; it only helps the malware find its C2 infrastructure. Since the question asks for the term describing the C2 communication capability, privilege escalation is unrelated to the observed behavior and is therefore incorrect.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.