mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: A security analyst for a medium-sized enterprise
You are a security analyst for a medium-sized enterprise. You notice that the network monitoring system has flagged an unusual amount of traffic between two internal hosts: 192.168.1.10 (a file server) and 192.168.1.20 (a workstation in the sales department). The traffic is occurring on port 445 (SMB) and is happening outside of normal business hours. The volume of data transferred is significantly higher than typical usage. The file server logs show that the sales workstation has been accessing a large number of files in quick succession. The sales employee reports that they have been working late, but they cannot explain the high volume of file access. You have access to the file server logs, network flow data, and the workstation's event logs. The workstation has antivirus software installed that is up to date. What should you do FIRST?
⚠ Common exam trap
Cisco often tests the incident response priority of containment over analysis; the trap here is that candidates choose analysis (Option D) or remediation (Option B/C) first, forgetting that immediate isolation prevents further damage and preserves evidence for later investigation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation from the network immediately
The anomalous SMB traffic on port 445, occurring outside business hours with a high volume of file access in quick succession, strongly indicates a ransomware or data exfiltration attack. Isolating the workstation immediately contains the threat, preventing lateral movement and further encryption or exfiltration of sensitive data. This aligns with the first step in incident response: containment before analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the workstation from the network immediately
Why this is correct
Isolation stops potential ransomware spread or data theft.
- ✗
Reimage the workstation to ensure it is clean
Why it's wrong here
Reimaging destroys evidence and is premature.
- ✗
Run a full antivirus scan on the workstation
Why it's wrong here
Scanning can occur after isolation, but isolation is priority.
- ✗
Analyze network flow data to identify the destination of the data
Why it's wrong here
Analysis should follow containment.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.