200-201 HTTP Response Codes Practice Question
A SOC analyst is investigating a web server log and sees the following entry: 192.168.1.10 - - [15/May/2023:10:15:30 +0000] 'POST /login.php HTTP/1.1' 200 1245 'http://example.com/login.php' 'Mozilla/5.0'. Which observation is most suspicious?
⚠ Common exam trap
Candidates may dismiss the 200 response code as normal, but in a security context, a successful login from an internal IP could be the result of a brute-force attack, making it the most suspicious element in a single log entry.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The response code 200 indicates successful login
The log entry shows a successful HTTP 200 response to a POST request to a login page. While a single 200 is normal, it is the most suspicious observation among the options because it indicates a successful login, which could be part of a brute force or credential stuffing attack if many attempts preceded it. The correct answer is A.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The response code 200 indicates successful login
Why this is correct
Correct. The 200 response code indicates a successful login, which is the most suspicious observation because it could represent the successful culmination of a brute-force attack.
- ✗
The source IP is internal
Why it's wrong here
Incorrect. The source IP being internal is common in enterprise environments and does not indicate suspicious activity by itself.
- ✗
The user-agent is generic
Why it's wrong here
Incorrect. While a generic user-agent can be used in attacks, it is also very common for legitimate clients and is not the most suspicious element here.
- ✗
The POST method is used for login
Why it's wrong here
Incorrect. The POST method is standard for submitting login forms and is not suspicious.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.