200-201 Security Monitoring Practice Question
A SOC analyst is analyzing logs from multiple sources. Which THREE log types are most useful for detecting a brute force attack against a web application?
⚠ Common exam trap
Cisco often tests the distinction between raw logs (like authentication, web server, and firewall logs) and derived alerts (like IDS/IPS alerts), tricking candidates into selecting IDS/IPS alerts because they seem directly relevant, but the question specifically asks for log types, not alert types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
System authentication logs
System authentication logs (B) are critical because they record every login attempt, including failed ones, which directly reveals the repeated authentication failures characteristic of a brute force attack. Web server logs (C) capture HTTP request details such as source IP, URI, and response codes (e.g., 401 Unauthorized or 403 Forbidden), allowing an analyst to correlate many failed login requests from a single source. Firewall logs (E) show allowed and denied connections, enabling detection of high volumes of inbound traffic to the web application's port (e.g., TCP 443 or 80) from a specific IP, which is a common brute force pattern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS logs
Why it's wrong here
DNS logs show domain queries, not login attempts.
- ✓
System authentication logs
Why this is correct
System logs record failed/successful logins.
- ✓
Web server logs
Why this is correct
Web logs contain login POST requests and response codes.
- ✗
IDS/IPS alerts
Why it's wrong here
IDS/IPS may detect attack signatures but not the count of failed logins directly.
- ✓
Firewall logs
Why this is correct
Firewall logs show source IPs and connection attempts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.