mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: An analyst reviews Snort alert logs and sees many…
An analyst reviews Snort alert logs and sees many alerts for 'SQL Injection Attempt' from a single external IP to a public-facing web server. Which analysis step is most effective?
⚠ Common exam trap
Test-takers frequently choose to block the IP immediately (Option A) as a 'quick fix' without realizing that incident response requires validation and evidence collection before taking containment actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the web server logs for the same IP
Checking the web server logs for the same IP is the most effective step because it allows the analyst to correlate the Snort alerts with actual HTTP requests. This confirms whether the SQL injection attempts were successful or merely reconnaissance, and provides context such as the specific URI, parameters, and response codes (e.g., 200 vs 500) needed to assess impact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the IP at the firewall immediately
Why it's wrong here
Incorrect. Blocking without validation could be premature if the IP is legitimate.
- ✓
Check the web server logs for the same IP
Why this is correct
Correct. Web server logs show the actual HTTP requests and can confirm if the attacks were attempted.
- ✗
Run a port scan against the IP
Why it's wrong here
Incorrect. Port scanning the attacker may be illegal and does not help analyze the alert.
- ✗
Disable the SQL injection signature
Why it's wrong here
Incorrect. Disabling signatures reduces security posture.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.