easyMultiple ChoiceObjective-mapped
200-201 Practice Question: An analyst notices an intrusion alert triggered…
An analyst notices an intrusion alert triggered by an internal host scanning multiple ports on a single external IP address. The signature is 'Port Scan'. Which of the following is the most likely cause?
⚠ Common exam trap
Cisco often tests the distinction between scanning a single external IP (network mapping) versus scanning many internal IPs (malware spreading), causing candidates to confuse the target scope with the scanning pattern.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network mapping tool
A port scan targeting multiple ports on a single external IP is the classic behavior of network mapping tools like Nmap or Masscan. These tools systematically probe ports to discover open services, which is distinct from the random or sequential scanning patterns of malware or the limited connections of normal user activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Misconfigured service
Why it's wrong here
Misconfigured services may cause scanning but not typically to a single external IP.
- ✗
Malware spreading
Why it's wrong here
Malware often spreads to multiple internal hosts, not a single external IP.
- ✓
Network mapping tool
Why this is correct
Network mapping tools like Nmap perform port scans for reconnaissance.
- ✗
Normal user activity
Why it's wrong here
Normal users do not perform port scans.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.