mediumMultiple Choice
Incident Response: Containment vs Eradication
An organization uses Windows 10 Enterprise workstations with standard user accounts (no local admin). Users run daily tasks including web browsing, document editing, and accessing a corporate intranet. Recently, the security team detected anomalous outbound traffic from one workstation to an IP address in a foreign country. The workstation's host-based firewall shows that a process named 'svch0st.exe' initiated the connection. Additionally, a scheduled task named 'UpdateTask' runs every hour with SYSTEM privileges, executing a script from a hidden folder. The user reports no unusual behavior except occasional system slowdowns. The analyst must determine the best immediate course of action. Which action should the analyst take first?
Quick Answer
The correct immediate action is to disable the scheduled task and terminate the svch0st.exe process, then collect a forensic image. This answer is correct because it prioritizes containment—stopping the active outbound communication and disabling the persistence mechanism—while preserving the system state for later eradication and root-cause analysis. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your understanding of the incident response lifecycle, specifically the critical distinction between containment (halting the threat’s spread and immediate damage) and eradication (removing all traces of the malware). A common trap is to jump straight to eradication by deleting files or reimaging the system, which destroys volatile evidence like the scheduled task artifacts and network logs. Remember the memory tip: “Contain before you clean—stop the bleed, then collect the scene.” This ensures you balance stopping the attacker’s actions with preserving forensic integrity, a key skill for the exam’s focus on practical response workflows.
⚠ Common exam trap
Cisco often tests the distinction between containment (stopping the active threat) and eradication (removing files), where candidates mistakenly choose to delete artifacts immediately (Option C) instead of first containing the process and preserving evidence for analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the scheduled task and terminate the svch0st.exe process, then collect a forensic image of the workstation for further analysis
The immediate priority is to contain the threat by disabling the scheduled task and terminating the malicious process (svch0st.exe) to stop further outbound communication, while preserving the system state for forensic analysis. Collecting a forensic image ensures that evidence (e.g., the script, scheduled task artifacts, and network logs) is not destroyed, allowing the security team to perform root-cause analysis and determine the full scope of the compromise. This approach balances containment with evidence preservation, which is critical in incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run an antivirus scan and if nothing is found, ignore the alert as a false positive
Why it's wrong here
A clean antivirus scan does not clear the indicators: the misspelt svch0st.exe, foreign outbound connection and SYSTEM-level scheduled task are host-based persistence evidence that signature scanning routinely misses. Scanning suits commodity malware detection on routine endpoints, not active compromise triage where the alert itself demands investigation.
- ✗
Immediately disconnect the workstation from the network and perform a full system restore from a known good backup
Why it's wrong here
Restoring from backup destroys volatile evidence — running processes, network connections and the hidden script — before scoping the compromise, and the scheduled task would simply re-execute after restore if the persistence mechanism survives. It is tempting because isolation and rebuild are standard containment for confirmed, fully-scoped infections where eradication is guaranteed.
- ✗
Delete the scheduled task and the script from the hidden folder, then reboot the workstation
Why it's wrong here
Deleting the task and script removes only the observed persistence mechanism, leaving the initial access vector and any other implants intact; the attacker can re-establish within hours. Removing known malicious artefacts is appropriate during eradication, once the full scope of compromise has been established through investigation.
- ✓
Disable the scheduled task and terminate the svch0st.exe process, then collect a forensic image of the workstation for further analysis
Why this is correct
Terminating the malicious process and disabling the SYSTEM-level scheduled task halts active command-and-control and persistence, satisfying the need to contain the threat immediately. Capturing a forensic image afterwards preserves volatile and disk evidence before remediation destroys artefacts needed to scope the compromise.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A financial firm uses Sysmon for endpoint monitoring on all Windows servers. One server, 'FIN-SRV-01', which hosts a critical database application, is exhibiting high CPU usage and unusual outbound network connections to a known malicious IP on port 8080. The Sysmon logs show Event ID 1 (Process Create) with a suspicious process 'rundll32.exe' spawned from 'winword.exe', and Event ID 3 (Network Connect) showing the connection to the malicious IP. The antivirus has not detected any threats. The analyst must decide the next immediate action to contain the threat while preserving evidence.
easy- A.Reboot the server to clear any suspicious processes from memory.
- B.Immediately format the server's hard drive and reinstall the OS.
- C.Restore the server from the most recent backup taken yesterday.
- ✓ D.Isolate the server by disconnecting its network cable and taking a memory dump for further analysis.
Why D: Isolating the server by disconnecting its network cable immediately stops the outbound communication to the malicious IP on port 8080, containing the threat without destroying volatile evidence. Taking a memory dump preserves the running processes, including the suspicious rundll32.exe spawned from winword.exe, which is critical for forensic analysis of the attack chain. This approach aligns with incident response best practices: contain first, then analyze, while avoiding actions that could destroy evidence or alert the attacker.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.