mediumMultiple Choice
200-201 Practice Question: During a security incident, a security analyst…
During a security incident, a security analyst isolates an affected host and collects a memory dump. According to incident response procedures, what is the next step the analyst should take?
⚠ Common exam trap
Cisco often tests the misconception that immediate remediation (reboot or restore) is the priority, when in fact forensic preservation and analysis must occur first to understand the full scope of the compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Analyze the memory dump to identify indicators of compromise
After isolating the host and collecting a memory dump, the next step is to analyze the dump to extract volatile evidence such as running processes, network connections, and injected code. This analysis identifies indicators of compromise (IoCs) that inform containment and eradication. Skipping analysis would lose critical forensic data and hinder understanding of the attack vector.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reboot the host to clear any malware from memory
Why it's wrong here
Rebooting destroys volatile memory, including the malware and forensic artefacts just captured, and may let malware re-execute from persistence. Rebooting is a legitimate first-line troubleshooting step for a hung or non-critical workstation, but not during evidence collection on an isolated incident host.
- ✗
Notify the public relations team immediately
Why it's wrong here
Public relations notification is a communications step taken later, once the incident is scoped and confirmed, and only if disclosure is required. It does not advance containment or analysis. PR involvement is correct for a confirmed breach with regulatory or reputational impact, not immediately after memory capture.
- ✗
Restore the host from a known good backup
Why it's wrong here
Restoring from backup is a recovery action, but incident response procedure after isolating and capturing memory is to preserve and analyse evidence, then contain and eradicate. Backups are used once the threat is removed and the environment is clean, not while the compromised host still holds forensic artefacts.
- ✓
Analyze the memory dump to identify indicators of compromise
Why this is correct
With the host isolated and volatile memory captured, the immediate priority is examining that dump for indicators of compromise, since memory holds running processes, injected code and network artefacts lost once power is removed or the system is rebooted.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.