200-201 Security Monitoring Practice Question
A security analyst is analyzing system logs and notices multiple failed authentication events followed by a successful login from the same user account, and then a privilege escalation event. Which THREE events should be correlated to detect a potential attack?
⚠ Common exam trap
Cisco often tests the concept that a single successful login alone is not suspicious, but when combined with preceding failed attempts and subsequent privilege escalation, it forms a clear attack pattern that candidates must recognize as a three-event correlation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Successful authentication event
A successful authentication event following multiple failed attempts is a key indicator of a brute-force or password-spraying attack. The analyst must correlate the failed attempts with the eventual success to identify that the attacker gained access after guessing or cracking the credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Successful authentication event
Why this is correct
The success after failures indicates the attacker gained access.
- ✓
Privilege escalation event
Why this is correct
Escalation after login is a common step to gain higher privileges.
- ✓
Failed authentication events
Why this is correct
Multiple failures suggest a brute-force attempt.
- ✗
Network share access event
Why it's wrong here
Share access may be lateral movement but not directly correlated with the initial compromise.
- ✗
Account creation event
Why it's wrong here
Account creation is for persistence, not necessarily part of the initial compromise sequence.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.