hardMultiple ChoiceObjective-mapped
200-201 Practice Question: A cybersecurity firm is conducting a red team…
A cybersecurity firm is conducting a red team exercise for a client. The red team successfully gained access to the client's internal network through a phishing email and escalated privileges to domain administrator. During the exercise, the red team uses a tool to dump password hashes from the domain controller. The client's security team detects the hash dump activity and sends an alert to the SOC. The SOC analyst reviews the alert and sees that the source IP of the hash dump is from a server that is part of the red team's scope. However, the red team is not scheduled to perform hash dumping until the next phase. The analyst also notes that the activity uses a known red team tool. Which of the following actions is most appropriate?
⚠ Common exam trap
Cisco often tests the concept that authorized red team activity can still be out of scope, and the trap is assuming that any activity from an authorized IP is automatically benign, leading candidates to choose Option C instead of verifying with the red team lead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assume the red team is acting out of scope and contact the red team lead for clarification.
The red team is authorized to operate within the client's environment, but the activity occurred outside the scheduled phase, creating ambiguity. The most appropriate action is to contact the red team lead for clarification to determine if the hash dump was a deviation from the plan or a sign of a real attacker. This aligns with incident response best practices, which prioritize verification before escalation, especially when authorized testing is in progress.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Launch a full incident response procedure assuming a real attacker.
Why it's wrong here
This would be an overreaction and could waste resources if it is actually the red team.
- ✓
Assume the red team is acting out of scope and contact the red team lead for clarification.
Why this is correct
Given the source IP belongs to the red team and the tool is known, it is likely a schedule mismatch; contacting the lead is the best course.
- ✗
Treat the alert as a false positive because the red team is authorized.
Why it's wrong here
Ignoring the alert could allow a real attacker to hide if the red team is not actually performing the activity.
- ✗
Immediately block the red team's IP addresses and escalate to management.
Why it's wrong here
This could disrupt the authorized exercise and damage the client relationship if the red team is acting within scope.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.