hardMultiple ChoiceObjective-mapped
200-201 Practice Question: Is implementing monitoring for encrypted traffic…
An organization is implementing monitoring for encrypted traffic without decrypting it. Which approach would be most effective for detecting malicious activity?
⚠ Common exam trap
Cisco often tests the distinction between 'monitoring without decryption' and 'decryption-based inspection'—the trap is that candidates assume encrypted traffic is invisible to security tools, but metadata analysis (NetFlow) can reveal malicious patterns without ever seeing the plaintext.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use NetFlow analysis to identify unusual connection patterns
NetFlow analysis examines metadata (source/destination IPs, ports, protocols, byte counts) without decrypting the payload. Unusual patterns like beaconing to a known C2 server, data exfiltration via non-standard ports, or unexpected volumetric flows can indicate malicious activity even when the traffic is encrypted. This approach preserves privacy and compliance while still enabling threat detection through behavioral anomalies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy SSL/TLS inspection to decrypt traffic
Why it's wrong here
Decryption violates the requirement not to decrypt.
- ✓
Use NetFlow analysis to identify unusual connection patterns
Why this is correct
NetFlow metadata can indicate malicious behavior even in encrypted traffic.
- ✗
Monitor SNMP traffic from endpoints
Why it's wrong here
SNMP is management protocol, not traffic analysis.
- ✗
Block all encrypted traffic except from known good sources
Why it's wrong here
Blocking is too restrictive and not detection.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.