The answer is to isolate the workstation by disconnecting it from the network immediately. This is the correct immediate action because the symptoms—periodic short-lived outbound connections to an external IP on non-standard port 4444, combined with DNS queries to a suspicious domain resolving to that same IP—are textbook indicators of C2 beaconing detection and containment in incident response. The malware is likely establishing a command channel for data exfiltration or receiving instructions, and cutting the network link stops the threat from communicating, preventing further damage. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your ability to prioritize containment over analysis; a common trap is to run antivirus scans or check logs first, but the correct first step is always to stop the beaconing. Remember the mnemonic “Isolate Before Investigate” to lock in the priority for C2 incidents.
200-201 Network Intrusion Analysis Practice Question
This 200-201 practice question tests your understanding of network intrusion analysis. Compare every option against the stated constraints before choosing — the best answer satisfies all requirements, not just the most obvious one. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are a security analyst at a medium-sized company. A user reports that their workstation is running slowly and the network is sluggish. You check the firewall logs and see a large number of outgoing connections from the user's workstation to an external IP address (198.51.100.23) on port 4444. The connections are short-lived and occur every few seconds. The workstation has standard corporate antivirus installed, which is up-to-date and shows no threats. You have also noticed that the workstation is making DNS queries to an unusual domain (malicious.example.com) that resolves to the same external IP. What is the most appropriate immediate action?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation by disconnecting it from the network immediately.
The workstation exhibits classic signs of a command-and-control (C2) infection: periodic outbound connections to an external IP on a non-standard port (4444) and DNS queries to a suspicious domain. Isolating the workstation immediately (Option B) is the most appropriate action because it stops the potential data exfiltration and prevents the malware from receiving further commands, containing the threat before any analysis or remediation.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Block the external IP address on the firewall and continue monitoring.
Why it's wrong here
Blocking IP alone may not stop the malware from using other IPs.
✓
Isolate the workstation by disconnecting it from the network immediately.
Why this is correct
Isolation stops C2 communication and preserves evidence.
Related concept
Read the scenario before looking for a memorised answer.
✗
Run a full forensic analysis on the workstation without disconnecting it.
Why it's wrong here
Running forensic analysis while connected risks further damage.
✗
Update the antivirus signatures and run a full scan on the workstation.
Why it's wrong here
Antivirus may not detect custom malware; isolation is needed first.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the principle that containment (isolation) must precede analysis or remediation when active C2 traffic is observed, and the trap here is that candidates may choose to block the IP or run a scan, mistakenly thinking those actions are sufficient to stop the threat without removing the host from the network.
Detailed technical explanation
How to think about this question
Port 4444 is commonly associated with Metasploit's default reverse shell payload, and periodic short-lived connections are a hallmark of beaconing in C2 traffic, where the malware checks in at intervals to avoid detection. The DNS query to 'malicious.example.com' indicates the malware may be using domain generation algorithms (DGAs) or a static domain for resilience; isolating the workstation at the switch port (e.g., via 802.1X or manual shutdown) ensures the host cannot send or receive any packets, effectively breaking the C2 channel and preventing lateral movement.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Network Intrusion Analysis — This question tests Network Intrusion Analysis — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Isolate the workstation by disconnecting it from the network immediately. — The workstation exhibits classic signs of a command-and-control (C2) infection: periodic outbound connections to an external IP on a non-standard port (4444) and DNS queries to a suspicious domain. Isolating the workstation immediately (Option B) is the most appropriate action because it stops the potential data exfiltration and prevents the malware from receiving further commands, containing the threat before any analysis or remediation.
What should I do if I get this 200-201 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is reviewing logs from a network-based IPS that detected traffic from an internal host connecting to a known malicious IP address on port 6667. The traffic is encrypted IRC. Which conclusion is most likely?
medium
A.The traffic is a normal application update
B.The host is running a legitimate IRC client
✓ C.The host is compromised and part of a botnet
D.The IPS is generating a false positive
Why C: Port 6667 is the default port for IRC (Internet Relay Chat), and encrypted IRC traffic to a known malicious IP strongly indicates command-and-control (C2) communication. Botnets commonly use IRC over TLS/SSL to evade detection and issue commands to compromised hosts. Therefore, the host is most likely compromised and part of a botnet.
Variation 2. During a security incident, an analyst captures network traffic and observes multiple connections from an internal host to a remote IP on port 4444, with irregular packet timing and small payloads. Which type of activity is most likely indicated?
medium
✓ A.C2 beaconing
B.DNS tunneling
C.File transfer
D.VoIP communication
Why A: The observed traffic—multiple connections from an internal host to a remote IP on TCP port 4444, with irregular timing and small payloads—is a classic signature of command-and-control (C2) beaconing. Attackers often use non-standard high ports like 4444 to evade detection, and the irregular intervals (jitter) are intentionally introduced to avoid pattern-based anomaly detection, while small payloads minimize data transfer and reduce the chance of triggering network thresholds.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.