mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: An analyst reviews IDS alerts and sees multiple…
An analyst reviews IDS alerts and sees multiple alerts for the same signature from different internal IPs targeting the same external server. One common cause is...
⚠ Common exam trap
Cisco often tests the distinction between a DDoS attack and a worm by focusing on the source distribution—candidates mistakenly choose DDoS because they see multiple sources, but forget that DDoS sources are typically external, not internal, and the signature consistency points to a worm's automated propagation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A worm spreading internally
A worm spreading internally (option C) is the most likely cause because worms self-replicate and propagate across a network, generating identical IDS alerts from multiple internal IPs as each infected host attempts to connect to the same external server (e.g., for command-and-control or payload delivery). This pattern—same signature, multiple internal sources, single external target—is a classic indicator of worm activity, where the worm's propagation logic causes each compromised host to initiate similar outbound connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A false positive
Why it's wrong here
False positives would be random and not consistent across multiple hosts.
- ✗
A DDoS attack
Why it's wrong here
DDoS typically targets an internal server from external sources.
- ✓
A worm spreading internally
Why this is correct
Worm infections cause multiple hosts to exhibit similar malicious behavior.
- ✗
A misconfigured server
Why it's wrong here
Misconfiguration usually affects a single host.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.