easyMultiple ChoiceObjective-mapped
200-201 Practice Question: A hospital's network security team has received…
A hospital's network security team has received reports from nurses that the patient record system has become unresponsive. Upon investigation, the IT administrator finds that the database server is experiencing extremely high disk I/O and the system logs show repeated failed login attempts from an internal IP address that belongs to a medical imaging device. The imaging device is known to run an outdated embedded OS that cannot be patched. The device is isolated on its own VLAN, but the VLAN is allowed to communicate with the database server on TCP port 1433 for legitimate purposes. The attack logs show that the database server is being targeted with a dictionary attack using the default 'sa' account. What should the security analyst do first to contain the incident without disrupting critical medical operations?
⚠ Common exam trap
Cisco often tests the principle of 'least disruption' in incident response, and the trap here is that candidates instinctively choose network-level blocks (firewall or VLAN disable) without considering that the attack is credential-based and can be contained at the application layer, preserving critical business functions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the database server's 'sa' account password and implement account lockout policies.
The immediate priority is to stop the ongoing dictionary attack against the database server's 'sa' account without disrupting critical medical operations. Changing the 'sa' password and implementing account lockout policies directly mitigates the brute-force attack at the authentication layer, while leaving the imaging device and its VLAN operational so that legitimate medical imaging traffic can continue. This containment step buys time for a more permanent solution, such as replacing or further isolating the vulnerable device.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the imaging device's IP address at the core firewall.
Why it's wrong here
Blocking the IP would stop the attack but also prevent legitimate traffic from the device, which may be needed for medical operations.
- ✗
Take the imaging device offline immediately and isolate it from the network.
Why it's wrong here
Taking a critical medical device offline could impact patient diagnostics; it should only be done after exhausting other options.
- ✗
Disable the VLAN allowing communication between the imaging device and the database server.
Why it's wrong here
This would disrupt legitimate communication between the imaging device and the database, potentially affecting patient care.
- ✓
Change the database server's 'sa' account password and implement account lockout policies.
Why this is correct
This stops the ongoing dictionary attack without disrupting other services, as it targets the specific compromised account.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.