mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: A network intrusion detection system (NIDS)…
A network intrusion detection system (NIDS) generates an alert for a known exploit against a web server. The analyst verifies that the server is patched. What is the next best step?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate if the exploit was actually attempted
Even if the server is patched, the exploit attempt may indicate a broader attack or reconnaissance. Investigating the attempt helps determine intent and identify other compromised systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reconfigure the NIDS to block the traffic
Why it's wrong here
Incorrect. Blocking based on a single alert may be overly aggressive and could be done after investigation.
- ✗
Tune the signature to ignore the server
Why it's wrong here
Incorrect. Tuning may hide future attempts. Better to investigate.
- ✗
Dismiss the alert as a false positive
Why it's wrong here
Incorrect. The alert could still indicate malicious intent even if the server is patched.
- ✓
Investigate if the exploit was actually attempted
Why this is correct
Correct. Investigating the attempt can reveal attacker behavior and prevent future incidents.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.