mediumMultiple Choice
200-201 Practice Question: Analyzing network traffic from a compromised host
You are analyzing network traffic from a compromised host. The host is running Windows and is connected to a corporate network. The IDS generated an alert for a known malware signature matching traffic from the host to an external IP on port 443. However, you see that the traffic is encrypted and the destination IP is a cloud storage provider. The host also shows periodic DNS queries to a domain that closely resembles the cloud provider's domain but with a single character difference (typosquatting). The employee on that host reports no unusual activity. Which step should you take first to confirm the compromise?
⚠ Common exam trap
Cisco often tests the misconception that encrypted traffic cannot be analyzed at all, leading candidates to choose decryption (Option D) as the first step, when in fact DNS log correlation is a non-disruptive, immediate method to confirm the compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check DNS logs to see if the typosquatted domain resolved recently and correlate with the encrypted traffic timestamps.
Correlating DNS logs with encrypted traffic timestamps is the fastest, least intrusive way to confirm whether the host actually communicated with the typosquatted domain. If the DNS query for the lookalike domain resolved just before the encrypted session to the external IP, it strongly indicates the malware is using the typosquatted domain for command-and-control (C2) over HTTPS, bypassing simple domain-based blocklists. This step validates the alert without requiring decryption or assuming user reports are reliable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check DNS logs to see if the typosquatted domain resolved recently and correlate with the encrypted traffic timestamps.
Why this is correct
Correlating DNS resolution records with the encrypted session timestamps confirms whether the host actually contacted the typosquatted domain, establishing command-and-control or exfiltration infrastructure before touching the endpoint. Encrypted port 443 traffic alone cannot be inspected, so resolution evidence is the decisive first artefact.
- ✗
Dismiss the alert as a false positive because the user reports no issues.
Why it's wrong here
User reassurance does not negate the typosquatted DNS lookups and beaconing to an external IP, which are objective indicators requiring investigation. Dismissing alerts on user statements alone is tempting when noise is high, but it is only defensible after technical validation rules out the indicators.
- ✗
Examine the full packet capture for the encrypted session to see the payload.
Why it's wrong here
The session uses TLS on port 443, so the captured payload is ciphertext; examining it yields no readable content without decryption keys. Packet capture analysis is the right first step for cleartext protocols or when keys are available, not for encrypted C2 traffic.
- ✗
Enable SSL/TLS decryption on the corporate firewall to inspect the encrypted traffic.
Why it's wrong here
Decrypting at the firewall inspects only traffic crossing that perimeter, yet the typosquatting DNS queries and the matching signature already give unencrypted evidence to correlate; TLS interception also breaks certificate pinning and adds a proxy the host may bypass. It would suit inspecting content of a known plaintext-expecting flow.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.