mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: Uses both network-based intrusion detection…
An organization uses both network-based intrusion detection (NIDS) and host-based intrusion detection (HIDS). A HIDS alert reports that a critical server's registry key was modified. The NIDS shows no corresponding network activity. The change occurred during a scheduled maintenance window. What is the best course of action for the analyst?
⚠ Common exam trap
Cisco often tests the concept that maintenance windows do not automatically validate all changes; candidates must remember to verify against change management records rather than assuming safety or immediately escalating.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the change management system to see if the modification was authorized
The registry modification occurred during a scheduled maintenance window, which is a legitimate time for authorized changes. The analyst should first verify the change management system to confirm whether the modification was planned and approved, as this aligns with standard change control processes. The absence of NIDS alerts further suggests the change was likely local and non-malicious, but confirmation via change management is essential before taking any action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the alert because it occurred during maintenance
Why it's wrong here
While maintenance increases the chance of authorized changes, ignoring alerts could miss malicious activity disguised as maintenance.
- ✓
Check the change management system to see if the modification was authorized
Why this is correct
Scheduled maintenance windows often involve authorized changes; verifying with change management is the logical first step.
- ✗
Escalate the alert as a potential security incident
Why it's wrong here
Escalation without context may waste resources; maintenance windows are common sources of authorized changes.
- ✗
Immediately revert the registry change
Why it's wrong here
Reverting without authorization could interfere with legitimate maintenance activities.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.