hardMultiple Choice
200-201 An analyst sees these logs Practice Question
Exhibit
Refer to the exhibit. %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.1(12345) -> 192.168.1.1(22), 1 packet %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.2(54321) -> 192.168.1.1(22), 1 packet %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.3(11111) -> 192.168.1.1(22), 1 packet %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.4(22222) -> 192.168.1.1(22), 1 packet
An analyst sees these logs. What should be the immediate course of action?
⚠ Common exam trap
Cisco often tests the principle of 'verify before you act' to trap candidates who jump to reactive measures like blocking or changing ports without first confirming whether the traffic is authorized.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate whether these are legitimate SSH attempts from authorized remote administrators.
The logs show repeated SSH connection attempts from the 10.0.0.0/24 subnet. The immediate priority is to determine whether these are legitimate administrative activities or malicious brute-force attempts. Investigating first prevents unnecessary disruption to authorized remote administration, which is critical for maintaining network operations and security. Blocking or changing configurations without verification could inadvertently lock out legitimate administrators or violate change-control policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Investigate whether these are legitimate SSH attempts from authorized remote administrators.
Why this is correct
SSH authentication attempts may originate from sanctioned administrators, so the analyst must first establish whether the source addresses and accounts are authorised. Confirming legitimacy distinguishes routine remote administration from brute-force or intrusion activity before escalation or blocking.
- ✗
Change the SSH port to a non-standard port.
Why it's wrong here
Moving SSH to a non-standard port is security through obscurity and leaves the brute-force attempts unanswered. It is tempting because automated scanners often target port 22, but the logs show repeated authentication failures from specific sources that require immediate blocking or rate limiting.
- ✗
Block all traffic from the 10.0.0.0/24 subnet.
Why it's wrong here
Blocking the entire 10.0.0.0/24 subnet is overbroad and would sever legitimate internal traffic from that range. It is tempting because it instantly stops the observed attempts, but the correct immediate action targets only the specific offending source addresses identified in the logs.
- ✗
Add an ACL permit rule for SSH from these sources.
Why it's wrong here
Permitting SSH from the logged sources authorises the very traffic that is failing authentication repeatedly, effectively allowing the attack. It is tempting when those addresses belong to trusted administrators, but the log evidence indicates brute-force behaviour, so the sources should be denied instead.
- ✗
Disable SSH access to the router.
Why it's wrong here
Disabling SSH removes legitimate administrative access and does not stop the brute-force attempts observed in the logs. It is tempting as a hardening measure when remote management is unnecessary, but the immediate response should block the offending source addresses while preserving management connectivity.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.