easyMultiple ChoiceObjective-mapped
200-201 Practice Question: An analyst is monitoring network traffic and…
An analyst is monitoring network traffic and notices a host sending ICMP echo requests to multiple hosts in the same subnet with a pattern of incrementing TTL values. What is the most likely purpose of this activity?
⚠ Common exam trap
Cisco often tests the distinction between a ping sweep (fixed TTL, multiple destinations) and a traceroute (incrementing TTL, single destination), so the trap here is confusing the pattern of incrementing TTLs with a simple liveness scan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traceroute to map the network topology.
The pattern of incrementing TTL values in ICMP echo requests is the hallmark of a traceroute operation. Traceroute works by sending packets with TTL=1, then TTL=2, etc., so each successive router along the path decrements the TTL to 0 and sends back an ICMP Time Exceeded message, revealing the hop-by-hop path. The target host responds with an ICMP Echo Reply when the TTL is high enough to reach it, confirming the final hop.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS resolution attempt.
Why it's wrong here
DNS uses UDP/TCP, not ICMP.
- ✗
Ping sweep to identify active hosts.
Why it's wrong here
Ping sweep uses constant TTL.
- ✗
Denial of service attack against a specific host.
Why it's wrong here
DoS has high packet rate, not TTL variation.
- ✓
Traceroute to map the network topology.
Why this is correct
Incrementing TTL is typical of traceroute.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.