mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: Analyzing network traffic from a compromised host
You are analyzing network traffic from a compromised host. The host is running Windows and is connected to a corporate network. The IDS generated an alert for a known malware signature matching traffic from the host to an external IP on port 443. However, you see that the traffic is encrypted and the destination IP is a cloud storage provider. The host also shows periodic DNS queries to a domain that closely resembles the cloud provider's domain but with a single character difference (typosquatting). The employee on that host reports no unusual activity. Which step should you take first to confirm the compromise?
⚠ Common exam trap
Cisco often tests the misconception that encrypted traffic cannot be analyzed at all, leading candidates to choose decryption (Option D) as the first step, when in fact DNS log correlation is a non-disruptive, immediate method to confirm the compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check DNS logs to see if the typosquatted domain resolved recently and correlate with the encrypted traffic timestamps.
Correlating DNS logs with encrypted traffic timestamps is the fastest, least intrusive way to confirm whether the host actually communicated with the typosquatted domain. If the DNS query for the lookalike domain resolved just before the encrypted session to the external IP, it strongly indicates the malware is using the typosquatted domain for command-and-control (C2) over HTTPS, bypassing simple domain-based blocklists. This step validates the alert without requiring decryption or assuming user reports are reliable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check DNS logs to see if the typosquatted domain resolved recently and correlate with the encrypted traffic timestamps.
Why this is correct
DNS logs can show resolution of suspicious domains, indicating potential C2 communication.
- ✗
Dismiss the alert as a false positive because the user reports no issues.
Why it's wrong here
Users are often unaware of compromise; ignoring alerts is dangerous.
- ✗
Examine the full packet capture for the encrypted session to see the payload.
Why it's wrong here
Encrypted traffic cannot be decrypted without the key; full packet capture is not helpful for content.
- ✗
Enable SSL/TLS decryption on the corporate firewall to inspect the encrypted traffic.
Why it's wrong here
Decryption requires a proxy and is not a quick first step; also may violate privacy policies.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.