200-201 Security Monitoring Practice Question
An analyst is monitoring network traffic and sees a large number of TCP SYN packets sent to various ports on a single host from the same source IP. Which type of attack is most likely occurring?
⚠ Common exam trap
Cisco often tests the distinction between a port scan (reconnaissance, multiple ports) and a SYN flood (DoS, single port with high volume), so the trap here is confusing the reconnaissance technique of scanning many ports with the denial-of-service technique of overwhelming a single service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port scan
A port scan involves an attacker sending TCP SYN packets to multiple ports on a target host to determine which ports are open and listening. The key indicator is the single source IP targeting various ports on a single host, which matches the behavior of a SYN scan (half-open scan) used to map services without completing the full TCP three-way handshake.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS amplification
Why it's wrong here
DNS amplification floods a victim with large DNS responses from many resolvers, not TCP SYNs sent directly to varied ports. It is tempting because both are volumetric denial-of-service attacks, and it would be correct if traffic showed small spoofed DNS queries producing oversized responses toward one target.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning manipulates MAC-to-IP mappings on the local subnet, generating spoofed ARP replies rather than TCP SYN packets across many ports. It is tempting because ARP attacks also involve a single source host, and it would be correct if the capture showed gratuitous ARP replies claiming a gateway's address.
- ✓
Port scan
Why this is correct
A port scan sends TCP SYN packets to many ports on one host to map which services are listening. Half-open scans exploit the SYN/ACK or RST response to classify each port as open, closed or filtered, matching the stem's single source IP and multiple destination ports.
- ✗
SYN flood
Why it's wrong here
A SYN flood sends many SYNs, but typically to one service port to exhaust its backlog, not sweeping various ports on a single host; that pattern indicates port scanning. It is tempting because SYN volume is the visible symptom, and it would be correct if the target port were fixed and half-open connections accumulated.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.