200-201 Security Monitoring Practice Question
An analyst is reviewing web server logs and sees the following entries: 'GET /admin/login.php HTTP/1.1' returning 404, followed by 'GET /admin/login.html' returning 404, then 'GET /admin/login.asp' returning 200. Which TWO observations are most relevant?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The attacker is probing for valid login page paths
The sequence of requests probing different file extensions for the login page suggests a directory traversal or file enumeration attack. The fact that the attacker tried multiple extensions and succeeded with .asp may indicate the web server is running ASP. The 200 response is the successful access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The attacker is probing for valid login page paths
Why this is correct
The sequence shows an attempt to find the correct login page by trying different extensions.
- ✗
The requests indicate a brute-force login attempt
Why it's wrong here
Brute-force would involve multiple passwords, not different file extensions.
- ✗
The source IP is likely performing a SQL injection
Why it's wrong here
No SQL syntax is present in the URLs; it's file enumeration.
- ✗
The server is misconfigured to reveal directory listings
Why it's wrong here
There is no evidence of directory listing; the attacker is guessing filenames.
- ✓
The successful 200 response indicates the attacker accessed the login page
Why this is correct
The 200 status code shows the request for /admin/login.asp was successful.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.