mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: A security analyst notices repeated failed login…
A security analyst notices repeated failed login attempts to a critical server from a single external IP address over the past 30 minutes. The SIEM has a correlation rule that triggers an alert when the threshold of 10 failed attempts in 5 minutes is exceeded. However, no alert was generated. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the distinction between event frequency over a long period versus event rate within a specific time window, trapping candidates who assume any repeated failed login attempts will trigger an alert regardless of the correlation rule's temporal constraints.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The correlation rule uses a sliding window, and the failed attempts occurred over more than 5 minutes.
The SIEM correlation rule uses a sliding window that triggers an alert only when 10 failed attempts occur within a 5-minute window. Since the analyst observed repeated failed attempts over 30 minutes, the attempts are spread across multiple 5-minute windows, so no single window exceeds the threshold. This is a classic case where the event frequency is high overall but does not meet the rule's temporal aggregation criteria.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SIEM is not receiving logs from the authentication server.
Why it's wrong here
Logs are received, but the rule did not trigger due to time window.
- ✓
The correlation rule uses a sliding window, and the failed attempts occurred over more than 5 minutes.
Why this is correct
Threshold not met in any 5-minute window.
- ✗
The analyst is monitoring the wrong log source.
Why it's wrong here
Logs are correct; window aggregation is the issue.
- ✗
The SIEM correlation rule requires a minimum of 15 failed attempts.
Why it's wrong here
Rule threshold is 10.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.