easyMultiple ChoiceObjective-mapped
200-201 A security analyst at a medium-sized company Practice Question
You are a security analyst at a medium-sized company. The company uses a SIEM that collects logs from firewalls, IDS/IPS, and endpoint detection and response (EDR) agents. You receive an alert that a user's workstation (IP 10.0.1.25) has been making outbound connections to an IP address (198.51.100.10) on port 4444 (commonly used by malware). The alert includes a SIEM correlation rule that triggered when three or more connections to that IP occurred within 5 minutes. You check the EDR logs and see that the workstation is running a process named 'svchost.exe' that is connecting to that IP. The process path is C:\Windows\system32\svchost.exe, which is legitimate. However, you notice that the process has a digital signature from 'Microsoft Corporation', but the signature date is from 2021. The workstation's operating system is Windows 10 22H2, fully patched as of last month. The user reports that they have been experiencing slow performance and occasional pop-ups. Which action should you take FIRST to investigate this potential compromise?
⚠ Common exam trap
Cisco often tests the misconception that a valid digital signature on a process executable guarantees the process is clean, when in reality attackers frequently use signed Microsoft binaries as hosts for malicious code via injection or sideloading.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the EDR to list all DLLs loaded by svchost.exe and look for any suspicious DLLs that are not from Microsoft.
The presence of a legitimate svchost.exe with a valid Microsoft signature does not rule out DLL sideloading or injection. By listing all DLLs loaded by the process, you can identify suspicious non-Microsoft DLLs that may be executing malicious code within the trusted svchost.exe context, which is a common technique used by malware to evade detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a full system reimage of the workstation to ensure the malware is removed.
Why it's wrong here
Reimaging should be a last resort after evidence collection; you need to confirm compromise first.
- ✓
Use the EDR to list all DLLs loaded by svchost.exe and look for any suspicious DLLs that are not from Microsoft.
Why this is correct
This can detect DLL sideloading or injection, which is a common technique.
- ✗
Immediately block the outbound connection to 198.51.100.10 at the firewall and isolate the workstation from the network.
Why it's wrong here
Isolation may be needed later, but first you should gather more evidence to confirm compromise.
- ✗
Verify the digital signature of svchost.exe with Microsoft to ensure it has not been revoked.
Why it's wrong here
The signature is valid and not revoked; but malware can use a legitimate signed file.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.