mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: A manufacturing company's ICS network was…
A manufacturing company's ICS network was infected with ransomware that encrypted files on the file server. The company has offline backups and restores the files. However, during the investigation, the security analyst finds that the ransomware entered through an RDP connection from an infected workstation on the corporate network. The corporate network and ICS network are separated by a firewall that allows RDP from specific corporate IPs to the ICS file server. The analyst wants to prevent a recurrence. Which of the following is the most effective long-term control?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require multi-factor authentication for all RDP connections.
Requiring multi-factor authentication for all RDP connections adds a critical layer of security, making it much harder for attackers to gain access even if credentials are compromised.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Require multi-factor authentication for all RDP connections.
Why this is correct
MFA significantly reduces the risk of unauthorized RDP access even if passwords are compromised.
- ✗
Disable RDP on the ICS file server and use a jump box.
Why it's wrong here
A jump box can reduce exposure but still requires strong authentication; MFA on RDP is more direct.
- ✗
Implement network segmentation with a DMZ for file transfers.
Why it's wrong here
Segmentation is good but does not prevent access if RDP is still allowed and credentials are stolen.
- ✗
Install antivirus on all corporate workstations.
Why it's wrong here
Antivirus may not prevent a targeted attack using stolen credentials.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are common security controls used to defend against ransomware?
medium- ✓ A.Implementing application whitelisting
- B.Allowing macros in office documents
- C.Disabling user accounts after 3 failed attempts
- ✓ D.Regular offline backups
- ✓ E.Network segmentation to limit lateral movement
Why A: Application whitelisting is a security control that prevents unauthorized executables, scripts, and macros from running. By default allowing only approved software, it blocks ransomware payloads that arrive as unknown or untrusted files, even if a user inadvertently executes them.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.