200-201 Security Concepts Practice Question
A security analyst discovers that an attacker is using a vulnerability scanning tool to identify open ports on the company's network. Which type of attack is being performed?
⚠ Common exam trap
The trap is confusing active vs. passive reconnaissance; candidates often think 'scanning' is passive because it's information gathering, but any direct interaction with the target is active.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Active reconnaissance
Active reconnaissance involves directly interacting with the target system to gather information, such as port scanning, vulnerability scanning, or banner grabbing. Using a vulnerability scanning tool to identify open ports sends packets to the target and elicits responses, which is the definition of active reconnaissance. This contrasts with passive reconnaissance, which collects information without direct interaction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Social engineering
Why it's wrong here
Social engineering manipulates people into divulging information or performing actions; scanning open ports involves no human interaction, so it does not describe this activity. It is tempting because attackers often combine reconnaissance with phishing, but the observed tooling is technical port enumeration, not deception of users.
- ✗
Passive reconnaissance
Why it's wrong here
Passive reconnaissance observes traffic or public sources without directly touching the target, whereas a vulnerability scanner actively sends probes to the company's hosts and receives responses. It is tempting because scanning precedes exploitation, but the direct interaction makes this active reconnaissance.
- ✓
Active reconnaissance
Why this is correct
Active reconnaissance involves directly interacting with the target to gather information, such as port scanning, which generates traffic and can be detected. Vulnerability scanning tools probing open ports are actively engaging the network, distinguishing this from passive reconnaissance.
- ✗
Denial of Service
Why it's wrong here
Denial of Service aims to exhaust resources and disrupt availability; port scanning merely enumerates listening services and causes no outage. It is tempting because scanning can precede a DoS attack, but the described activity is reconnaissance, not traffic flooding or resource exhaustion.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.