200-201 Security Monitoring Practice Question
A network security analyst is reviewing traffic logs and notices a series of connections from an internal host to a known command-and-control (C2) server. The connections occur every 5 minutes and are small in size. Which of the following is the MOST likely explanation for this traffic pattern?
⚠ Common exam trap
The trap here is dismissing the periodic nature as benign (like updates or NTP) without considering the destination reputation and the context of a known C2 server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The host is infected with malware that is beaconing to its C2 server.
Periodic connections to a known C2 server are a strong indicator of malware beaconing. Malware often uses beaconing to maintain communication with its controller, receiving commands and exfiltrating data. The regular interval and small payload size are typical to avoid detection. Other options describe benign or different malicious activities that do not match the scenario, especially the destination being a known C2 server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The host is synchronizing time with an NTP server.
Why it's wrong here
NTP synchronization typically occurs on UDP port 123 and connects to NTP servers, not known C2 servers. The periodicity might be similar, but the destination and protocol would differ. The presence of a known C2 server rules out NTP.
- ✗
The host is running a legitimate software update service that checks for updates every 5 minutes.
Why it's wrong here
While software update services can be periodic, they typically connect to vendor servers, not known C2 servers. Additionally, update checks often transfer more data when updates are available. The destination being a known C2 server strongly indicates malicious activity, not legitimate updates.
- ✗
The host is part of a botnet and is being used to scan other hosts.
Why it's wrong here
Scanning activity would involve connections to multiple destinations, often on various ports, not just to a single C2 server. The described pattern is of beaconing, not scanning. While a botnet member might beacon, the specific behavior here is check-in, not scanning.
- ✓
The host is infected with malware that is beaconing to its C2 server.
Why this is correct
Regular, periodic connections to a known C2 server are characteristic of malware beaconing. The interval and small data size suggest the malware is checking in for instructions. This is a common detection for command-and-control activity. The analyst should investigate the host for compromise and block the C2 communication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.