hardMultiple ChoiceObjective-mapped
200-201 Practice Question: A security analyst for a medium-sized enterprise…
A security analyst for a medium-sized enterprise is monitoring the network using Cisco Stealthwatch. They notice a sudden spike in traffic originating from an internal host (IP 10.10.10.50) communicating with multiple external IP addresses on port 445 (SMB). The host is a Windows server that typically serves web applications on ports 80 and 443. The analyst checks the host's firewall logs and finds that Windows Firewall is disabled. The host's antivirus is up to date and no alerts were triggered. The traffic pattern shows multiple connection attempts to /24 subnets across the internet, each with a single packet per destination. Based on this behavior, what is the most likely issue?
⚠ Common exam trap
Cisco often tests the distinction between reconnaissance (scanning) and attack (exploitation/DDoS), where candidates may confuse the single-packet scanning pattern with DDoS amplification or legitimate scanning, but the key is the lack of handshake completion and the disabled firewall indicating compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The host is infected with malware that is performing network reconnaissance.
The traffic pattern—multiple connection attempts to /24 subnets across the internet, each with a single packet per destination—is classic behavior for network reconnaissance, specifically scanning for open SMB ports. The host's Windows Firewall being disabled and the lack of antivirus alerts indicate that the host is likely compromised and running malware that is performing this reconnaissance, as legitimate scanning or DDoS amplification would not exhibit this single-packet-per-destination pattern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The host is infected with malware that is performing network reconnaissance.
Why this is correct
The pattern matches malware scanning for SMB vulnerabilities (e.g., EternalBlue).
- ✗
The host is part of a distributed vulnerability scanning initiative.
Why it's wrong here
No indication of authorization; also the host's typical function is web serving, not scanning.
- ✗
The host is being used for a DDoS amplification attack.
Why it's wrong here
DDoS amplification uses spoofed sources and large responses; here traffic is scanning many destinations.
- ✗
The host is legitimately scanning the internet for outdated SMB shares.
Why it's wrong here
Legitimate scans would be authorized and typically use more targeted ranges.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.