Security Monitoring →mediumMultiple ChoiceObjective-mapped

200-201 Security Monitoring Practice Question

A firewall log shows repeated denied packets from IP 10.0.0.5 to destination 192.168.1.10 on port 22. What is the most likely attack?

⚠ Common exam trap

Cisco often tests the association between specific port numbers and common attack types, so the trap here is that candidates may confuse port 22 with HTTP (port 80) or SMB (port 445) and pick a wrong answer based on the attack name rather than the port number.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SSH brute force

Repeated denied packets from a single source IP to a specific destination on port 22 (SSH) indicate a brute-force attack, where an attacker attempts multiple username/password combinations to gain unauthorized access. The firewall logs show the traffic is being blocked, but the pattern of repeated attempts is characteristic of an SSH brute-force attack, not a flood or exploit targeting other services.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
HTTP flood
Why it's wrong here
HTTP uses port 80/443.
✗
SMB exploit
Why it's wrong here
SMB uses port 445.
✓
SSH brute force
Why this is correct
Repeated connection attempts on port 22 suggest SSH brute force.
✗
DNS amplification
Why it's wrong here
DNS uses port 53, not 22.

Go deeper

200-201 Security Monitoring Practice Question

Why each option matters

Option-by-option breakdown

Related to this question