The correct immediate response is to reset the password for user 'jdoe', block outbound traffic to the remote server at the firewall, and initiate the incident response process. This combination is critical because the sequence of events—brute-force logon attempts followed by a successful logon and an encoded PowerShell command attempting a payload download—confirms a host compromise where the attacker has gained authenticated access. Resetting the password immediately cuts off the attacker's lateral movement by revoking their credentials, while blocking outbound traffic prevents the payload download and command-and-control communication, effectively containing the breach. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your ability to prioritize containment actions during incident response after host compromise, often appearing as a multi-step question where traps include focusing only on isolating the host or analyzing logs without taking action. A common memory tip is "Credentials, C2, Contain": reset credentials first, block C2 traffic second, then initiate formal containment procedures.
200-201 Host-Based Analysis Practice Question
This 200-201 practice question tests your understanding of host-based analysis. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Microsoft Windows Event Logging for host monitoring. The security team receives an alert from a Windows 10 workstation 'WS-102' indicating multiple failed logon attempts (Event ID 4625) within a short period from an internal IP address 10.10.10.50, followed by a successful logon (Event ID 4624) for user 'jdoe'. Shortly after, Event ID 4688 (Process Creation) shows 'cmd.exe' started by 'explorer.exe' with a command line launching 'powershell.exe -EncodedCommand ...'. The encoded command decodes to a script that attempts to download a payload from a remote server. The analyst needs to determine the most effective immediate response to limit lateral movement and impact.
Restore WS-102 from a known good backup and ignore the alert as a false positive.
Why wrong: Ignoring could lead to further compromise.
B
Immediately reset the password for user 'jdoe', block outbound traffic to the remote server at the firewall, and initiate an incident response process.
Resets credentials, stops C2 communication, and begins formal response.
C
Run a full antivirus scan on WS-102 and isolate it.
Why wrong: Antivirus may not detect all threats and isolation alone may not stop lateral movement.
D
Disable the user account 'jdoe' and investigate the source IP 10.10.10.50.
Why wrong: Disabling the account without resetting may allow password reuse.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Immediately reset the password for user 'jdoe', block outbound traffic to the remote server at the firewall, and initiate an incident response process.
Option B is correct because the sequence of events—brute-force logon attempts followed by a successful logon and then an encoded PowerShell command attempting to download a payload—indicates a confirmed compromise. Resetting the password for 'jdoe' immediately revokes the attacker's authenticated access, blocking outbound traffic to the remote server prevents the payload download and C2 communication, and initiating incident response ensures proper containment and investigation. This combination directly limits lateral movement by cutting off the attacker's credentials and network egress.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Restore WS-102 from a known good backup and ignore the alert as a false positive.
Why it's wrong here
Ignoring could lead to further compromise.
✓
Immediately reset the password for user 'jdoe', block outbound traffic to the remote server at the firewall, and initiate an incident response process.
Why this is correct
Resets credentials, stops C2 communication, and begins formal response.
Related concept
Read the scenario before looking for a memorised answer.
✗
Run a full antivirus scan on WS-102 and isolate it.
Why it's wrong here
Antivirus may not detect all threats and isolation alone may not stop lateral movement.
✗
Disable the user account 'jdoe' and investigate the source IP 10.10.10.50.
Why it's wrong here
Disabling the account without resetting may allow password reuse.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between reactive steps (like scanning or disabling accounts) and proactive containment actions that immediately cut off the attacker's access and communication channels, leading candidates to choose a less effective response that does not address both credential compromise and network egress.
Detailed technical explanation
How to think about this question
Windows Event ID 4625 (failed logon) and 4624 (successful logon) are part of the Security log, while Event ID 4688 (Process Creation) with command-line auditing reveals the exact encoded PowerShell command. The '-EncodedCommand' parameter uses Base64 encoding, which can be decoded to reveal the script's intent; in this case, it attempts an outbound HTTP/HTTPS download, which can be blocked at the firewall by creating a rule to deny traffic to the remote server's IP or domain. Resetting the password invalidates any Kerberos or NTLM tokens the attacker may have captured, preventing reuse of the compromised credentials for lateral movement.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Host-Based Analysis — This question tests Host-Based Analysis — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Immediately reset the password for user 'jdoe', block outbound traffic to the remote server at the firewall, and initiate an incident response process. — Option B is correct because the sequence of events—brute-force logon attempts followed by a successful logon and then an encoded PowerShell command attempting to download a payload—indicates a confirmed compromise. Resetting the password for 'jdoe' immediately revokes the attacker's authenticated access, blocking outbound traffic to the remote server prevents the payload download and C2 communication, and initiating incident response ensures proper containment and investigation. This combination directly limits lateral movement by cutting off the attacker's credentials and network egress.
What should I do if I get this 200-201 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst is investigating a suspicious file on a Windows host. The file hash matches a known malware variant in a threat intelligence feed. What is the next best step for host-based analysis?
easy
A.Run a full antivirus scan on the host
B.Disable the network adapter to prevent further communication
✓ C.Check for persistence mechanisms such as registry Run keys or scheduled tasks
D.Reboot the host to clear the malware from memory
Why C: Option C is correct because after confirming a file hash matches a known malware variant, the immediate priority for host-based analysis is to determine how the malware maintains persistence on the system. Persistence mechanisms such as Registry Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) or scheduled tasks (via schtasks.exe) allow malware to survive reboots and re-establish execution. Identifying these artifacts is critical for containment and eradication, as it reveals the malware's foothold and prevents re-infection after removal.
Last reviewed: Jun 25, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.