mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: An analyst sees this syslog message on the Cisco…
Exhibit
Refer to the exhibit. %ASA-4-733100: [10.10.10.10] drop rate-1 exceeded. Current burst rate is 1050 bursts per second, max configured rate is 1000.
An analyst sees this syslog message on the Cisco ASA. What is the most likely cause of this alert?
⚠ Common exam trap
Cisco often tests the distinction between a DoS attack and a misconfiguration by embedding syslog messages that reference rate-based thresholds (e.g., 'Drop rate exceeded') rather than explicit ACL deny messages, leading candidates to mistakenly choose 'misconfigured firewall' when the alert is actually a security event.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A DoS attack
The syslog message likely indicates a high rate of connection attempts or incomplete sessions (e.g., %ASA-4-106017: Deny TCP due to SYN flood or %ASA-4-733100: Drop rate exceeded). This is characteristic of a Denial of Service (DoS) attack, where an attacker overwhelms the firewall with traffic to exhaust resources or disrupt service. Option C is correct because the ASA's threshold-based alerting specifically triggers on abnormal traffic volumes that match DoS patterns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Normal traffic spike
Why it's wrong here
Normal spikes rarely exceed configured drop rate limits, which are set to allow typical traffic patterns.
- ✗
A routing loop
Why it's wrong here
Routing loops cause packet TTL expiration, not increased burst rates on a single device.
- ✓
A DoS attack
Why this is correct
The high burst rate exceeding the configured max is consistent with a DoS attack overwhelming the firewall.
- ✗
A misconfigured firewall
Why it's wrong here
Misconfiguration typically causes policy violations or connectivity issues, not a burst rate drop alert.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.