hardMultiple ChoiceObjective-mapped
Cisco CyberOps Associate: Data Exfiltration Indicators — Consistent Bit Rate and Packet Size
A security analyst is reviewing NetFlow records and notices a host sending data to an external IP at regular intervals during non-business hours. Which flow characteristic is most indicative of data exfiltration?
Quick Answer
The answer is a constant bit rate and consistent packet size, as these flow characteristics are the most indicative of data exfiltration in NetFlow records. This pattern reveals a scripted, automated transfer—often a beacon or covert channel—designed to fly under the radar by maintaining a steady, low-and-slow rhythm, which starkly contrasts with legitimate traffic’s variable packet sizes and bursty behavior. On the Cisco CyberOps Associate 200-201 exam, this concept tests your ability to spot data exfiltration indicators within NetFlow data, a key skill for distinguishing malicious transfers from normal network activity. A common trap is mistaking high-volume bursts for exfiltration, but the real threat often hides in consistent, low-rate flows during off-hours. Remember the mnemonic “Steady and Small” to recall that exfiltration favors constant bit rates and uniform packet sizes to evade detection.
⚠ Common exam trap
Cisco often tests the misconception that data exfiltration always involves large volumes of data or many small packets, when in fact the hallmark of stealthy exfiltration is consistency and regularity to blend in with normal traffic patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Constant bit rate and consistent packet size.
Data exfiltration often uses a steady, low-and-slow approach to evade detection. A constant bit rate and consistent packet size indicate a scripted, automated transfer, such as a beacon or a covert channel, which is highly suspicious during non-business hours. This pattern contrasts with legitimate traffic, which typically shows variable packet sizes and bursty behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Random destination ports.
Why it's wrong here
Random ports suggest port scanning, not data exfiltration.
- ✗
High number of small packets.
Why it's wrong here
This is typical of DoS or network scanning, not exfiltration.
- ✗
Low number of bytes per flow.
Why it's wrong here
Low bytes could be normal keepalive traffic.
- ✓
Constant bit rate and consistent packet size.
Why this is correct
Data exfiltration tools often send data at a steady rate to avoid suspicion.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst notices a sudden spike in NetFlow data from a single workstation to multiple external IP addresses on port 443. What is the most likely explanation for this traffic pattern?
easy- A.Internal network scanning
- B.Normal web browsing activity
- ✓ C.Potential data exfiltration
- D.A scheduled software update
Why C: A single workstation sending a sudden spike of NetFlow data to multiple external IP addresses on port 443 (HTTPS) is a classic indicator of data exfiltration. Attackers often encrypt stolen data in HTTPS tunnels to evade detection, and the abrupt increase in outbound connections to many distinct external hosts is not typical of normal user behavior. NetFlow records showing a high volume of flows from one source to many destinations on the same port strongly suggest an automated process, such as a data theft tool, rather than legitimate traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.