200-201 Network Intrusion Analysis Practice Question
An analyst is reviewing a network intrusion alert and sees a large number of ICMP echo requests sent from a single external IP to multiple internal hosts. The ICMP payloads are identical and the requests are sent in rapid succession. Which type of activity does this most likely represent?
⚠ Common exam trap
The trap here is assuming any high-volume ICMP traffic is a denial-of-service attack, but a ping sweep targets multiple hosts for discovery, not a single host for resource exhaustion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ICMP ping sweep for host discovery
The rapid succession of identical ICMP echo requests to multiple internal hosts is a classic ping sweep, used to discover live hosts on a network. Attackers often perform ping sweeps during reconnaissance to map the network before launching further attacks. The identical payloads and multiple targets distinguish it from a denial-of-service flood or tunneling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Smurf attack amplification
Why it's wrong here
A Smurf attack spoofs the source IP of a target and sends ICMP echo requests to broadcast addresses, causing many hosts to reply to the target. Here, the requests are sent directly to multiple internal hosts without spoofing or broadcast, so it is not a Smurf attack.
- ✗
ICMP flood denial-of-service attack
Why it's wrong here
An ICMP flood typically targets a single host with a high volume of ICMP echo requests to overwhelm its resources. Here, the requests are sent to multiple internal hosts, which suggests a scanning or discovery activity rather than a flood aimed at one target.
- ✗
ICMP tunneling for data exfiltration
Why it's wrong here
ICMP tunneling involves embedding data within ICMP packets to covertly transfer information. While the payloads are identical, there is no indication of data being extracted or command-and-control communication. The rapid requests to multiple hosts are more consistent with host discovery.
- ✓
ICMP ping sweep for host discovery
Why this is correct
A ping sweep sends ICMP echo requests to multiple IP addresses to identify which hosts are alive. The scenario describes rapid, identical ICMP echo requests to multiple internal hosts, which is characteristic of a ping sweep used for network reconnaissance before a more targeted attack.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.