mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: A security analyst notices repeated failed login…
A security analyst notices repeated failed login attempts from an external IP. The company has a policy for account lockout after 5 failed attempts. However, the lockout is not triggering. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the misconception that all authentication failures in an enterprise are tracked by Active Directory, when in fact legacy or third-party applications may have independent authentication stores that bypass AD lockout policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The failed attempts are occurring on a legacy application that does not integrate with Active Directory.
Legacy applications often use their own authentication mechanisms that do not integrate with Active Directory (AD). Since the lockout policy is enforced by AD based on failed logon attempts against domain-joined systems, attempts against a non-integrated legacy application bypass AD's lockout threshold entirely. This explains why the policy is not triggering despite repeated failures from the external IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The failed attempts are occurring on a legacy application that does not integrate with Active Directory.
Why this is correct
Legacy apps often bypass domain policy.
- ✗
The lockout threshold is set to 10 attempts.
Why it's wrong here
Not indicated in scenario.
- ✗
The lockout policy is applied to user accounts but not to administrative accounts.
Why it's wrong here
Does not explain failure with external IP.
- ✗
The intrusion prevention system is blocking the lockout mechanism.
Why it's wrong here
IPS does not typically interfere with lockout.
- ✗
The firewall is allowing the traffic but not logging.
Why it's wrong here
Irrelevant to lockout.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.