mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: During a security incident, a security analyst…
During a security incident, a security analyst isolates an affected host and collects a memory dump. According to incident response procedures, what is the next step the analyst should take?
⚠ Common exam trap
Cisco often tests the misconception that immediate remediation (reboot or restore) is the priority, when in fact forensic preservation and analysis must occur first to understand the full scope of the compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Analyze the memory dump to identify indicators of compromise
After isolating the host and collecting a memory dump, the next step is to analyze the dump to extract volatile evidence such as running processes, network connections, and injected code. This analysis identifies indicators of compromise (IoCs) that inform containment and eradication. Skipping analysis would lose critical forensic data and hinder understanding of the attack vector.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reboot the host to clear any malware from memory
Why it's wrong here
Rebooting can destroy evidence; isolation and analysis should come first.
- ✗
Notify the public relations team immediately
Why it's wrong here
Public notification should occur after confirmation and containment, not immediately.
- ✗
Restore the host from a known good backup
Why it's wrong here
Restoration is part of recovery, which occurs after analysis and eradication.
- ✓
Analyze the memory dump to identify indicators of compromise
Why this is correct
Analysis is the logical next step after data collection to determine the cause and extent.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.