mediumMultiple ChoiceObjective-mapped
Detecting Malware Beaconing from Known Malicious Domains — IDS Alert Interpretation
Exhibit
Refer to the exhibit. Event: 1, Signature: GPL TROJAN Zeus Variant Outbound Connection Timestamp: 2023-09-15 14:23:45 Src IP: 10.0.0.25:49152 -> Dst IP: 198.51.100.10:80 Protocol: TCP Packet: GET /gate.php HTTP/1.1 Host: malware.example.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:45.0) Event: 2, Signature: ET POLICY Outgoing HTTP Request with Suspicious User-Agent Timestamp: 2023-09-15 14:23:46 Src IP: 10.0.0.25:49153 -> Dst IP: 198.51.100.10:80 Protocol: TCP Packet: GET /images/logo.png HTTP/1.1 Host: malware.example.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:45.0)
Refer to the exhibit. The analyst sees two IDS alerts from the same source. What should the analyst conclude?
Quick Answer
The answer is that the host is likely infected with malware. This conclusion is drawn because the IDS alerts show repeated connections from the same source IP to a known malicious domain, evil.com, using a suspicious user-agent string—a classic pattern of malware beaconing detection from known malicious domain traffic, where infected hosts periodically check in with a command-and-control server. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your ability to distinguish true positives from false positives by correlating multiple alert attributes, such as destination reputation and user-agent anomalies, rather than relying on a single alert. A common trap is dismissing repeated alerts as benign noise, but the combination of a known bad domain and consistent beaconing behavior strongly indicates compromise. Memory tip: think “same source, same bad domain, same odd user-agent” as the beaconing trifecta—if all three align, it’s malware, not a glitch.
⚠ Common exam trap
Cisco often tests the distinction between a false positive and a true positive by making candidates focus on the user-agent being common, but the key is that the destination is known malicious, not the user-agent's commonality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The host is likely infected with malware
The IDS alerts indicate the same source IP is communicating with a known malicious domain (evil.com) using a suspicious user-agent string. This pattern of repeated connections to a known bad destination is characteristic of malware beaconing or command-and-control (C2) traffic, not a false positive or benign activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The alerts are false positives because the user-agent is common
Why it's wrong here
The user-agent is outdated and suspicious.
- ✗
The host is being scanned
Why it's wrong here
Scanning would involve multiple ports or IPs.
- ✓
The host is likely infected with malware
Why this is correct
Multiple alerts to a known malicious domain suggest infection.
- ✗
The host is downloading a large file
Why it's wrong here
The GET requests are small, not large files.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A NetFlow analysis shows a single internal host communicating with many external IP addresses on port 443, but the traffic volumes are very low (small packets). What is the most likely explanation?
easy- A.Phishing
- B.Web browsing
- C.Port scanning
- ✓ D.C2 communication
Why D: The combination of a single internal host communicating with many external IPs on port 443 (HTTPS) with very low traffic volumes and small packets is a classic indicator of command-and-control (C2) beaconing. C2 malware often uses HTTPS to blend in with legitimate web traffic, but the small, periodic packets (e.g., keep-alive or heartbeat messages) distinguish it from normal web browsing, which would involve larger data transfers and consistent payload sizes.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.