easyMultiple ChoiceObjective-mapped
200-201 Practice Question: Based on the exhibit, which host is likely…
Exhibit
Refer to the exhibit. Router# show ip cache flow IP packet size distribution: ... Top talkers sorted by bytes: Src IP Dst IP Pr Src P Dst P Bytes Flows 10.0.0.1:12345 203.0.113.1:80 6 12345 80 123456 10 10.0.0.1:12346 203.0.113.2:443 6 12346 443 234567 15 10.0.0.2:33456 203.0.113.3:53 17 33456 53 45678 5 10.0.0.3:44567 203.0.113.4:22 6 44567 22 1234 2
Based on the exhibit, which host is likely engaged in data exfiltration?
⚠ Common exam trap
Cisco often tests the concept that data exfiltration is indicated by a high volume of outbound traffic to an external destination, especially over encrypted channels, and the trap here is that candidates may overlook the byte count asymmetry and focus only on the destination port or protocol, missing the key behavioral indicator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
10.0.0.1
Host 10.0.0.1 is likely engaged in data exfiltration because the exhibit shows a large volume of outbound TCP traffic from this IP to an external destination on port 443 (HTTPS), with a significantly higher byte count compared to other hosts. This pattern is consistent with data being encrypted and sent to an external server, a common exfiltration technique to bypass inspection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
10.0.0.1
Why this is correct
This host has large volumes of data to external web servers.
- ✗
10.0.0.3
Why it's wrong here
SSH traffic volume is very low.
- ✗
10.0.0.2
Why it's wrong here
DNS traffic is typically low volume and not indicative of exfiltration.
- ✗
None of the above
Why it's wrong here
Host 10.0.0.1 shows suspicious activity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.