easyMultiple ChoiceObjective-mapped
200-201 Practice Question: An analyst notices that a host is sending large…
An analyst notices that a host is sending large amounts of data to an external IP address on TCP port 22 during non-business hours. What is the most likely activity?
⚠ Common exam trap
Cisco often tests the misconception that SSH is only used for remote administration, causing candidates to overlook the data exfiltration angle when large data transfers occur on port 22 during suspicious hours.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data exfiltration via SSH
SSH (TCP port 22) is commonly used for secure remote administration, but the scenario describes large data transfers to an external IP during non-business hours, which is a classic indicator of data exfiltration. Attackers often use SSH tunneling to bypass security controls and exfiltrate data because SSH encrypts the traffic, making it difficult for network monitoring tools to inspect the payload. The combination of high volume, external destination, and off-hours activity strongly suggests malicious data theft rather than legitimate administrative tasks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remote administration
Why it's wrong here
Remote administration is legitimate but the timing and volume suggest exfiltration.
- ✗
DNS query
Why it's wrong here
DNS uses port 53.
- ✗
FTP file transfer
Why it's wrong here
FTP uses port 21, not 22.
- ✓
Data exfiltration via SSH
Why this is correct
SSH on port 22 can be used to tunnel data out.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.