mediumMultiple ChoiceObjective-mapped
Incident Response: Containment vs Eradication
An organization uses Windows 10 Enterprise workstations with standard user accounts (no local admin). Users run daily tasks including web browsing, document editing, and accessing a corporate intranet. Recently, the security team detected anomalous outbound traffic from one workstation to an IP address in a foreign country. The workstation's host-based firewall shows that a process named 'svch0st.exe' initiated the connection. Additionally, a scheduled task named 'UpdateTask' runs every hour with SYSTEM privileges, executing a script from a hidden folder. The user reports no unusual behavior except occasional system slowdowns. The analyst must determine the best immediate course of action. Which action should the analyst take first?
Quick Answer
The correct immediate action is to disable the scheduled task and terminate the svch0st.exe process, then collect a forensic image. This answer is correct because it prioritizes containment—stopping the active outbound communication and disabling the persistence mechanism—while preserving the system state for later eradication and root-cause analysis. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your understanding of the incident response lifecycle, specifically the critical distinction between containment (halting the threat’s spread and immediate damage) and eradication (removing all traces of the malware). A common trap is to jump straight to eradication by deleting files or reimaging the system, which destroys volatile evidence like the scheduled task artifacts and network logs. Remember the memory tip: “Contain before you clean—stop the bleed, then collect the scene.” This ensures you balance stopping the attacker’s actions with preserving forensic integrity, a key skill for the exam’s focus on practical response workflows.
⚠ Common exam trap
Cisco often tests the distinction between containment (stopping the active threat) and eradication (removing files), where candidates mistakenly choose to delete artifacts immediately (Option C) instead of first containing the process and preserving evidence for analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the scheduled task and terminate the svch0st.exe process, then collect a forensic image of the workstation for further analysis
The immediate priority is to contain the threat by disabling the scheduled task and terminating the malicious process (svch0st.exe) to stop further outbound communication, while preserving the system state for forensic analysis. Collecting a forensic image ensures that evidence (e.g., the script, scheduled task artifacts, and network logs) is not destroyed, allowing the security team to perform root-cause analysis and determine the full scope of the compromise. This approach balances containment with evidence preservation, which is critical in incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run an antivirus scan and if nothing is found, ignore the alert as a false positive
Why it's wrong here
Antivirus may not detect the malware, and ignoring could allow persistent access.
- ✗
Immediately disconnect the workstation from the network and perform a full system restore from a known good backup
Why it's wrong here
This is too drastic and may not preserve evidence; also, a restore could reintroduce the infection if the backup is compromised.
- ✗
Delete the scheduled task and the script from the hidden folder, then reboot the workstation
Why it's wrong here
Deleting the script destroys evidence; the analyst should preserve it for analysis.
- ✓
Disable the scheduled task and terminate the svch0st.exe process, then collect a forensic image of the workstation for further analysis
Why this is correct
This stops malicious activity while preserving the script and other evidence on disk for later analysis.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A financial firm uses Sysmon for endpoint monitoring on all Windows servers. One server, 'FIN-SRV-01', which hosts a critical database application, is exhibiting high CPU usage and unusual outbound network connections to a known malicious IP on port 8080. The Sysmon logs show Event ID 1 (Process Create) with a suspicious process 'rundll32.exe' spawned from 'winword.exe', and Event ID 3 (Network Connect) showing the connection to the malicious IP. The antivirus has not detected any threats. The analyst must decide the next immediate action to contain the threat while preserving evidence.
easy- A.Reboot the server to clear any suspicious processes from memory.
- B.Immediately format the server's hard drive and reinstall the OS.
- C.Restore the server from the most recent backup taken yesterday.
- ✓ D.Isolate the server by disconnecting its network cable and taking a memory dump for further analysis.
Why D: Isolating the server by disconnecting its network cable immediately stops the outbound communication to the malicious IP on port 8080, containing the threat without destroying volatile evidence. Taking a memory dump preserves the running processes, including the suspicious rundll32.exe spawned from winword.exe, which is critical for forensic analysis of the attack chain. This approach aligns with incident response best practices: contain first, then analyze, while avoiding actions that could destroy evidence or alert the attacker.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.