200-201 Security Concepts Practice Question
A security analyst observes repeated failed login attempts from a single external IP address, causing the authentication server to become unresponsive. Which type of attack is occurring?
⚠ Common exam trap
200-201 often tests the confusion between brute force and DoS when both involve failed logins — the discriminator is the attacker's objective: credential compromise (brute force) versus service unavailability (DoS).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Denial of Service
The scenario describes repeated failed login attempts from a single external IP that render the authentication server unresponsive — this is a Denial of Service (DoS) condition, where the volume of authentication requests exhausts server resources (CPU, connection table, lock contention) and denies service to legitimate users. The defining symptom is availability loss, not credential compromise or information gathering. A brute force attack would aim to guess credentials, but here the observed outcome is service unavailability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Denial of Service
Why this is correct
Flooding authentication with repeated failed logins from one external IP exhausts server resources until it stops responding, which is the defining effect of a Denial of Service attack. The stem's unresponsive authentication server confirms availability, not confidentiality, is the target.
- ✗
Reconnaissance
Why it's wrong here
Reconnaissance gathers information through scanning or enumeration without overwhelming the authentication service; repeated failed logins causing unresponsiveness is not information gathering. It is tempting because scanning often precedes authentication attacks, but here the server degradation itself contradicts passive discovery.
- ✗
Brute force attack
Why it's wrong here
A brute force attack systematically guesses credentials, but the stem describes volume-driven resource exhaustion from one source, which is a denial-of-service pattern rather than credential guessing. It is tempting because failed logins feature in both, yet brute force targets account compromise, not server unavailability.
- ✗
Man-in-the-middle
Why it's wrong here
A man-in-the-middle intercepts or relays traffic between two parties, requiring positioning within the communication path; it does not generate volume failed logins that exhaust an authentication server. It is tempting whenever credentials are involved, but no interception or session manipulation is described.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.