200-201 Security Monitoring Practice Question
An IDS/IPS alert shows a signature named 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent' with severity high. What is the most likely next step for an analyst?
⚠ Common exam trap
Cisco often tests the distinction between 'policy' and 'exploit' signatures, where candidates mistakenly treat a policy violation as an immediate threat and jump to blocking, rather than following the proper incident response process of investigation first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate the source IP and user-agent for malicious activity
The 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent' signature indicates a policy violation, not necessarily a confirmed attack. An analyst must first investigate the source IP and user-agent to determine if the traffic is malicious (e.g., command-and-control communication, data exfiltration) or benign (e.g., a legitimate application using a non-standard user-agent). Immediate blocking (Option A) could disrupt legitimate services, while ignoring the alert (Option D) risks missing a real threat.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately block the source IP on the firewall
Why it's wrong here
Blocking the source IP is premature: the signature flags an outbound request from an internal host, so the firewall rule would sever a compromised machine rather than contain it. Blocking suits confirmed inbound malicious traffic; here the analyst should first investigate the host and user agent.
- ✗
Reset the IDS/IPS signature database
Why it's wrong here
Resetting the signature database discards detection rules and does not investigate the alert; the analyst should triage the suspicious user-agent traffic, correlating logs and endpoints. It tempts because outdated signatures cause false positives, but that maintenance task follows confirming a signature is stale, not a high-severity policy alert.
- ✓
Investigate the source IP and user-agent for malicious activity
Why this is correct
The signature flags an unusual User-Agent in outbound HTTP, which may indicate malware beaconing or command-and-control traffic. Correlating the source IP with the User-Agent string confirms whether the host is compromised, satisfying the need to validate the alert before escalation.
- ✗
Ignore the alert as it is not a critical signature
Why it's wrong here
Severity high means the alert cannot be dismissed; ET POLICY signatures still warrant triage because they may reveal command-and-control beaconing or data exfiltration. Ignoring fits known false positives already tuned out via suppression rules, not an uninvestigated high-severity event.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.