hardMultiple ChoiceObjective-mapped
200-201 Practice Question: Your organization uses a SIEM solution (Cisco…
Your organization uses a SIEM solution (Cisco Secure Network Analytics and Cisco Secure Cloud Analytics) for monitoring. You are the lead analyst and receive multiple alerts: (1) A host on the internal network is making thousands of outbound connections to a known malicious IP on port 80 in a short time. (2) At the same time, there is a spike in DNS queries from the same host to a domain that is registered very recently. (3) The firewall logs show that the host is communicating with internal servers on high ports (e.g., 4444, 5555). The host is a Windows 10 workstation used by the finance department. The user reports it has been slow recently. You have access to Cisco AMP for Endpoints, Cisco Firepower NGFW, and Cisco Stealthwatch. The environment has 500 endpoints, and the network uses 802.1X authentication. What should be your first course of action?
⚠ Common exam trap
Cisco often tests the principle of 'containment before eradication' — candidates mistakenly choose to block the IP or scan the host, but the correct first step is always to isolate the compromised endpoint to stop the attack from spreading.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the host from the network immediately and begin investigation.
The combination of outbound connections to a known malicious IP, recent domain DNS queries, and internal C2-like traffic on high ports (4444, 5555) indicates a confirmed compromise. Immediate isolation via 802.1X or switch ACL stops lateral movement and data exfiltration while preserving forensic evidence. Cisco AMP for Endpoints can then be used to analyze the host offline without risking further spread.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the current baseline for the host to confirm it is anomalous.
Why it's wrong here
Baseline check is passive and delays response.
- ✗
Block the malicious IP at the firewall and continue monitoring.
Why it's wrong here
Blocking IP alone is insufficient; host may communicate internally.
- ✗
Update the antivirus signatures on the host and run a full scan.
Why it's wrong here
Scanning is slow and may not catch advanced malware.
- ✓
Isolate the host from the network immediately and begin investigation.
Why this is correct
Containment is the first priority before analysis.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.