The correct first action is to isolate the host from the network to prevent further command and control communication. This is because the combination of outbound HTTPS traffic to known C2 servers and algorithmically generated domain (AGD) DNS queries is a classic indicator of an active malware infection that has already established a command channel. In incident response, containment must precede analysis or remediation, as allowing the host to remain connected risks ongoing data exfiltration and additional payload delivery. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your understanding of the NIST incident response framework, specifically the containment phase, and the common trap is to jump to forensic analysis or endpoint scanning first. Remember the priority: when you see confirmed C2 indicators, isolate first, investigate second—think "C2 equals cut the cord."
200-201 Network Intrusion Analysis Practice Question
This 200-201 practice question tests your understanding of network intrusion analysis. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are a security analyst for a financial institution. Over the past hour, the intrusion detection system has generated multiple alerts for outbound traffic from a single internal host (10.0.0.50) to various external IP addresses on port 443. The alerts indicate that the host is making HTTPS connections to IPs that are associated with known command and control servers. Additionally, the host has been observed making DNS queries for domains that are algorithmically generated (e.g., rgj3k2.example.com, fh7d8s.example.net). The host is a Windows 10 workstation used by an employee in the accounting department. The employee reports that they have not noticed any unusual behavior, but they did click on a link in a phishing email yesterday. The network administrator confirms that the host's firewall rules allow outbound HTTPS traffic. You have access to endpoint logs, network flow data, and packet captures. Which course of action should you take FIRST?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the host from the network to prevent further C2 communication
Option A is correct because the immediate priority when confirmed C2 communication is detected is to contain the threat by isolating the host from the network. The combination of outbound HTTPS connections to known C2 servers and algorithmically generated domain (AGD) DNS queries strongly indicates active malware infection. Isolating the host (e.g., via network access control or switch port shutdown) stops data exfiltration and further command reception, which is the first step in incident response containment before any analysis or remediation.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Isolate the host from the network to prevent further C2 communication
Why this is correct
Isolation stops active communication and allows for forensic analysis.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Analyze packet captures to determine the full extent of the compromise
Why it's wrong here
Analysis is important but should not delay containment.
✗
Block all outbound HTTPS traffic from the network
Why it's wrong here
This would disrupt business operations and may not be necessary.
✗
Reimage the host immediately to remove the malware
Why it's wrong here
Reimaging destroys forensic evidence; analysis should precede reimaging.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the incident response priority order, and the trap here is that candidates choose analysis (Option B) or remediation (Option D) first, forgetting that containment (Option A) is the immediate required step per NIST SP 800-61 and Cisco's own incident handling framework.
Detailed technical explanation
How to think about this question
Algorithmically generated domains (AGDs) are a hallmark of domain generation algorithms (DGAs) used by malware to evade static blocklists; the DNS queries for random-looking subdomains (e.g., rgj3k2.example.com) indicate the malware is attempting to resolve C2 infrastructure. Outbound HTTPS on port 443 to known C2 IPs suggests the malware is using encrypted channels (TLS) to blend with normal traffic, making deep packet inspection (DPI) without decryption ineffective. In a real-world incident, isolating the host at the switch level (e.g., via 802.1X or manual port disable) stops all Layer 2/3 communication while preserving the host's state for forensic imaging.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Network Intrusion Analysis — This question tests Network Intrusion Analysis — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Isolate the host from the network to prevent further C2 communication — Option A is correct because the immediate priority when confirmed C2 communication is detected is to contain the threat by isolating the host from the network. The combination of outbound HTTPS connections to known C2 servers and algorithmically generated domain (AGD) DNS queries strongly indicates active malware infection. Isolating the host (e.g., via network access control or switch port shutdown) stops data exfiltration and further command reception, which is the first step in incident response containment before any analysis or remediation.
What should I do if I get this 200-201 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst observes a sudden spike in outbound traffic from a critical server to an external IP address on TCP port 443. The server is a web application server that normally only receives inbound connections. Which type of intrusion is most likely occurring?
hard
A.Distributed denial-of-service (DDoS) attack from the server
B.Brute-force attack on the server's SSH service
C.SQL injection attack against the server
✓ D.Command-and-control (C2) communication from malware on the server
Why D: A sudden spike in outbound traffic from a server that normally only receives inbound connections is a classic indicator of command-and-control (C2) communication. Malware on the server often establishes outbound HTTPS (TCP 443) connections to a C2 server to exfiltrate data or receive instructions, bypassing firewalls that typically allow outbound web traffic.
Variation 2. A Cisco Firepower appliance generates an intrusion specific event with the message 'MALWARE-CNC generic command and control traffic detected'. The analyst needs to determine if the alert is a true positive. Which additional data source would provide the most corroborating evidence?
hard
A.Application control logs
B.URL filtering logs
C.NetFlow records
✓ D.DNS query logs
Why D: DNS query logs are the most corroborating evidence because malware command-and-control (C2) traffic often relies on DNS to resolve the IP address of the C2 server. A sudden spike in NXDOMAIN responses, queries to algorithmically generated domains (DGA), or requests to known malicious domains in the DNS logs would directly confirm the C2 activity. This aligns with the 'MALWARE-CNC' signature, which specifically targets C2 communication patterns.
Variation 3. You are analyzing network traffic from a compromised host. The host is running Windows and is connected to a corporate network. The IDS generated an alert for a known malware signature matching traffic from the host to an external IP on port 443. However, you see that the traffic is encrypted and the destination IP is a cloud storage provider. The host also shows periodic DNS queries to a domain that closely resembles the cloud provider's domain but with a single character difference (typosquatting). The employee on that host reports no unusual activity. Which step should you take first to confirm the compromise?
medium
✓ A.Check DNS logs to see if the typosquatted domain resolved recently and correlate with the encrypted traffic timestamps.
B.Dismiss the alert as a false positive because the user reports no issues.
C.Examine the full packet capture for the encrypted session to see the payload.
D.Enable SSL/TLS decryption on the corporate firewall to inspect the encrypted traffic.
Why A: Option A is correct because correlating DNS logs with encrypted traffic timestamps is the fastest, least intrusive way to confirm whether the host actually communicated with the typosquatted domain. If the DNS query for the lookalike domain resolved just before the encrypted session to the external IP, it strongly indicates the malware is using the typosquatted domain for command-and-control (C2) over HTTPS, bypassing simple domain-based blocklists. This step validates the alert without requiring decryption or assuming user reports are reliable.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.