200-201 Network Intrusion Analysis Practice Question
An analyst notices that an internal host is sending periodic ICMP echo requests to an external IP, and the echo replies contain payloads that are longer than the default Windows ping payload. The payload bytes appear to be encoded and change with each reply. Which activity is most likely occurring?
⚠ Common exam trap
The trap here is dismissing ICMP as harmless because ping is allowed, while overlooking that payload size and content, not the protocol itself, reveal the tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ICMP tunneling used for command-and-control or data transfer
Non-default ICMP payload sizes with changing encoded bytes in echo replies indicate that data is being tunneled inside ICMP, a common covert channel for command-and-control or exfiltration. Latency measurement, path MTU discovery, and Smurf attacks produce different packet characteristics and do not involve variable encoded payloads in replies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ICMP tunneling used for command-and-control or data transfer
Why this is correct
ICMP tunneling hides data inside echo request and reply payloads, allowing covert communication through firewalls that permit ping. Non-default payload sizes and changing encoded bytes in replies are strong indicators that data is being exchanged, not just reachability tested. This matches the pattern of an ICMP-based covert channel.
- ✗
Path MTU discovery performed by the host
Why it's wrong here
Path MTU discovery relies on setting the Don't Fragment bit and adjusting packet size, not on embedding encoded data in echo replies. It also produces ICMP fragmentation-needed messages when the MTU is exceeded. The presence of changing payload bytes in replies does not fit this mechanism.
- ✗
Network latency measurement by a monitoring tool
Why it's wrong here
Latency measurement uses standard-sized ICMP echo requests and does not embed changing encoded payloads in replies. Monitoring tools send predictable payloads, often a fixed pattern or timestamp, and do not vary content between replies. The observed variability and larger size are inconsistent with simple latency checks.
- ✗
Smurf attack reflection against the external host
Why it's wrong here
A Smurf attack sends ICMP echo requests with a spoofed source to a broadcast address, causing many hosts to reply to the victim. Here the traffic is a direct exchange between one internal host and one external IP, with encoded replies. That pattern does not match the amplification and spoofing characteristics of a Smurf attack.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.