hardMultiple Choice
200-201 Practice Question: A SOC analyst examines an alert generated by an…
A SOC analyst examines an alert generated by an IDS. The alert indicates a potential SQL injection attempt. However, the analyst finds that the source IP is a known internal web server that performs legitimate database queries. What is the most likely explanation?
⚠ Common exam trap
Cisco often tests the distinction between a false positive (benign traffic flagged as malicious) and a true positive (actual attack), where candidates mistakenly assume any SQL pattern in traffic indicates compromise or misconfiguration rather than recognizing legitimate database queries from a trusted internal server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The traffic is legitimate but the IDS has a false positive
The source IP is a known internal web server that performs legitimate database queries. IDS signatures often trigger on SQL-like patterns in traffic, and when the traffic matches the signature but is actually benign (e.g., a web server sending parameterized queries), it constitutes a false positive. The analyst's verification that the source is a trusted internal server performing expected operations confirms the alert is not a true threat.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The web server is compromised
Why it's wrong here
A compromised web server would generate outbound SQL injection traffic, but the stem states the server performs legitimate database queries, so compromise is not the most likely explanation. Compromise fits when the source shows anomalous query patterns or connections to unfamiliar hosts.
- ✓
The traffic is legitimate but the IDS has a false positive
Why this is correct
The internal web server legitimately queries the database, so the signature matched normal application traffic rather than an attacker. The IDS flagged expected behaviour as malicious, which is the definition of a false positive, not a true compromise.
- ✗
The IDS is misconfigured
Why it's wrong here
A misconfigured IDS would flag traffic broadly or inconsistently, yet the alert correctly matched SQL-like patterns from a legitimate querying server. Misconfiguration fits when signatures produce repeated false positives across many unrelated hosts, not one plausible source.
- ✗
The analyst should ignore the alert
Why it's wrong here
Ignoring the alert discards a genuine detection that requires triage; the source being internal does not make the traffic benign. Dismissing alerts is never a valid explanation, and doing so would leave a possible true positive uninvestigated.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.