easyMultiple ChoiceObjective-mapped
200-201 Practice Question: A security analyst notices repeated failed login…
A security analyst notices repeated failed login attempts from a single IP address to the company's VPN gateway. Which action should the analyst take first?
⚠ Common exam trap
Cisco often tests the principle that investigation must precede action, tempting candidates to choose immediate blocking (Option B) because it seems proactive, but the correct first step is always to gather context to avoid disrupting legitimate traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate the source IP for malicious activity.
The first step in security monitoring is to investigate the source IP to determine if the failed login attempts are part of a brute-force attack, a misconfigured client, or a legitimate user error. Without context, blocking the IP or escalating prematurely could disrupt legitimate access or waste resources. The analyst should gather evidence (e.g., logs, timestamps, user accounts targeted) before taking further action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escalate to the incident response team immediately.
Why it's wrong here
Escalation without initial investigation may waste resources.
- ✗
Block the IP at the firewall immediately.
Why it's wrong here
Blocking without investigation may block legitimate users and does not confirm malicious intent.
- ✓
Investigate the source IP for malicious activity.
Why this is correct
Investigation helps determine the nature of the failed attempts before taking action.
- ✗
Ignore the activity as it may be a user error.
Why it's wrong here
Ignoring could allow a potential attack to succeed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.