easyMultiple ChoiceObjective-mapped
200-201 Practice Question: A security analyst observes a high volume of ICMP…
A security analyst observes a high volume of ICMP echo replies from multiple internal hosts to a single external IP address. Which type of network activity is most likely indicated?
⚠ Common exam trap
Cisco often tests the distinction between a Smurf attack and a ping sweep by emphasizing that in a Smurf attack the replies are directed to a spoofed victim IP (often internal), whereas here the replies go to a single external IP, making it a sweep.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ping sweep
A ping sweep uses ICMP echo requests to discover live hosts; the observed high volume of ICMP echo replies from multiple internal hosts to a single external IP indicates that the external IP sent a flood of echo requests, and the internal hosts are responding. This is the classic signature of a ping sweep (or ICMP sweep) where an attacker probes a range of internal addresses to map the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ping sweep
Why this is correct
Ping sweep sends ICMP echo requests to multiple hosts to discover live hosts.
- ✗
ARP spoofing
Why it's wrong here
ARP spoofing involves falsified ARP messages to redirect traffic, not ICMP.
- ✗
Port scan
Why it's wrong here
Port scan typically uses TCP or UDP probes to discover open ports, not ICMP echo replies.
- ✗
Smurf attack
Why it's wrong here
Smurf attack is a DDoS that uses ICMP echo requests to broadcast addresses, not a sweep mapping hosts.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.