200-201 Security Monitoring Practice Question
An analyst is triaging a host that antivirus flagged for a file named svchost.exe running from C:\Users\Public\Downloads. The file has a valid digital signature issued to a legitimate software publisher, and the hash matches a known-good installer component. The process is making outbound SMB connections to several internal servers. Which action best reflects sound security monitoring practice?
⚠ Common exam trap
The trap here is equating a valid digital signature with proof of benign behaviour, when signatures only attest to the publisher and file integrity, not to how or why the binary is running.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Escalate for investigation because a signed binary executing from a user-writable path and initiating internal SMB sessions is anomalous.
Signature validity and hash reputation address integrity, not intent or context. A trusted binary in a user-writable directory that opens SMB sessions to multiple internal servers is a behavioural red flag consistent with abuse for lateral movement, so the analyst should escalate, preserve evidence, and determine scope rather than dismiss or prematurely remediate the alert.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Close the alert as a false positive because the signature and hash both verify as trusted.
Why it's wrong here
Trusted signing and a known-good hash reduce likelihood of tampering but do not prove the execution context is benign. A legitimate binary can be abused, copied to an unusual path, or used as a living-off-the-land tool. Closing the alert solely on signature and hash evidence ignores the anomalous file location and the internal SMB fan-out that triggered scrutiny.
- ✓
Escalate for investigation because a signed binary executing from a user-writable path and initiating internal SMB sessions is anomalous.
Why this is correct
The combination of an unexpected path under a world-writable directory, a system-process name, and outbound SMB connections to multiple internal servers is a strong behavioural anomaly regardless of signature validity. Signed binaries are routinely abused for lateral movement, so the analyst should preserve volatile data and investigate parent process, logon session, and network peers before clearing the alert.
- ✗
Ignore the alert because the process name matches a legitimate Windows system binary.
Why it's wrong here
Name matching is trivially spoofed and is never sufficient validation. The genuine svchost.exe resides in System32 and is launched by services.exe with specific command-line arguments, none of which match execution from a Public Downloads folder. Treating the filename as proof of legitimacy is a common analytical error that allows masquerading malware to persist undetected.
- ✗
Immediately delete the file and the user profile, then document the incident as remediated.
Why it's wrong here
Destroying the file and profile before collecting volatile evidence eliminates process handles, network connections, and parent-child relationships that would confirm or refute malicious intent. It also prevents determining scope, such as which servers were contacted. Remediation should follow, not precede, triage and evidence preservation under a documented incident response process.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.