mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: A SOC analyst receives an alert from the SIEM…
A SOC analyst receives an alert from the SIEM indicating a high number of failed login attempts on a domain controller from a single IP address over the last 10 minutes. The source IP is a known internal workstation. What should be the analyst's FIRST action?
⚠ Common exam trap
Cisco often tests the candidate's ability to follow the proper incident response triage process, where the trap is to jump to a technical action (like blocking or escalating) before performing the simplest verification step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Contact the user to verify if they are experiencing login issues
The analyst's first priority is to verify the legitimacy of the failed login attempts before taking any disruptive action. Since the source IP is a known internal workstation, the most likely cause is a user error, such as a forgotten password or a locked account. Contacting the user allows the analyst to quickly confirm whether the activity is benign, avoiding unnecessary escalation or network disruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the source IP at the firewall
Why it's wrong here
Blocking without verification could impact a legitimate user.
- ✗
Escalate to the incident response team
Why it's wrong here
Escalation should happen after initial triage.
- ✗
Ignore the alert because it is from an internal IP
Why it's wrong here
Internal IPs can still be compromised or misconfigured.
- ✓
Contact the user to verify if they are experiencing login issues
Why this is correct
Contacting the user helps determine if the activity is intentional or a misconfiguration.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.