hardMultiple ChoiceObjective-mapped
200-201 An analyst sees these logs Practice Question
Exhibit
Refer to the exhibit. %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.1(12345) -> 192.168.1.1(22), 1 packet %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.2(54321) -> 192.168.1.1(22), 1 packet %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.3(11111) -> 192.168.1.1(22), 1 packet %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.4(22222) -> 192.168.1.1(22), 1 packet
An analyst sees these logs. What should be the immediate course of action?
⚠ Common exam trap
Cisco often tests the principle of 'verify before you act' to trap candidates who jump to reactive measures like blocking or changing ports without first confirming whether the traffic is authorized.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate whether these are legitimate SSH attempts from authorized remote administrators.
The logs show repeated SSH connection attempts from the 10.0.0.0/24 subnet. The immediate priority is to determine whether these are legitimate administrative activities or malicious brute-force attempts. Investigating first prevents unnecessary disruption to authorized remote administration, which is critical for maintaining network operations and security. Blocking or changing configurations without verification could inadvertently lock out legitimate administrators or violate change-control policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Investigate whether these are legitimate SSH attempts from authorized remote administrators.
Why this is correct
Verify before acting.
- ✗
Change the SSH port to a non-standard port.
Why it's wrong here
Does not address the source.
- ✗
Block all traffic from the 10.0.0.0/24 subnet.
Why it's wrong here
Could block legitimate traffic.
- ✗
Add an ACL permit rule for SSH from these sources.
Why it's wrong here
May grant unauthorized access.
- ✗
Disable SSH access to the router.
Why it's wrong here
Could disrupt management.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.