200-201 Network Intrusion Analysis Practice Question
During an intrusion analysis, a SOC analyst reviews logs showing an outbound connection from an internal host to an external IP at 03:00 AM every 60 seconds. The traffic is HTTPS to a suspicious domain with a high entropy name. Which phase of the Cyber Kill Chain does this activity represent?
⚠ Common exam trap
200-201 often tests whether candidates can distinguish C2 (periodic callbacks to attacker infrastructure) from Delivery (initial payload transmission) — the presence of 'external IP' in the question tempts candidates toward Delivery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Command and Control (C2)
Periodic outbound HTTPS connections to a suspicious high-entropy domain at fixed intervals are the classic signature of Command and Control (C2) beaconing, where an implant checks in with its controller for instructions. The regularity (every 60 seconds) and the high-entropy domain name (typical of DGA or attacker-registered infrastructure) are the defining indicators. This activity occurs after exploitation and installation, when the malware establishes its channel back to the attacker.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Actions on Objectives
Why it's wrong here
Actions on Objectives covers the attacker achieving goals such as exfiltration or encryption; regular beaconing is command-and-control, not objective fulfilment. It is tempting because beaconing ultimately precedes exfiltration, and would be correct once data theft or ransomware execution is observed.
- ✗
Delivery
Why it's wrong here
Delivery is the initial transmission of the weaponised payload to the victim; recurring 60-second callbacks indicate an established implant already running. It is tempting because the traffic arrives from outside, and would be correct for the first inbound email attachment or exploit served to the host.
- ✓
Command and Control (C2)
Why this is correct
Regular beaconing at fixed 60-second intervals to an external suspicious high-entropy domain over HTTPS indicates an implanted host checking in with its controller. This periodic callback traffic is the hallmark of the Command and Control phase of the Cyber Kill Chain.
- ✗
Weaponisation
Why it's wrong here
Weaponisation is coupling an exploit with a payload on the attacker's own infrastructure, producing no victim-side network traffic. It is tempting because a high-entropy domain suggests crafted malware, and would be correct when analysing the build stage before anything reaches the target.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.