The answer is a known C2 server in a threat intelligence feed and the same source IP connecting to the same destination IP every 60 seconds. The threat feed entry is strong evidence because it directly corroborates the destination as malicious infrastructure, turning a suspicion into a confirmed indicator of compromise. The periodic connection every 60 seconds reinforces this by demonstrating the beaconing behavior typical of C2 channels, where compromised hosts check in at fixed intervals to receive commands. On the Cisco CyberOps Associate 200-201 exam, this question tests your ability to distinguish between circumstantial clues—like unusual packet sizes—and definitive evidence that ties traffic to known threats. A common trap is to focus on packet size alone, but the exam wants you to prioritize external validation and consistent timing patterns. Remember the memory tip: “Feed and Frequency”—a threat feed confirms the bad actor, while regular frequency confirms the bot.
200-201 Security Monitoring Practice Question
This 200-201 practice question tests your understanding of security monitoring. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is reviewing the firewall log exhibit. The analyst suspects that this traffic might be part of a command-and-control (C2) communication based on the packet size and the timing of similar events. Which TWO additional pieces of evidence would most strongly support the suspicion of C2 traffic?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The destination IP is listed in a threat intelligence feed as a known C2 server.
Option B is correct because a destination IP listed in a threat intelligence feed as a known C2 server directly indicates that the endpoint is associated with malicious command-and-control infrastructure. This external corroboration is strong evidence that the traffic is part of a C2 channel, as threat feeds aggregate confirmed indicators of compromise (IoCs) from multiple sources.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The packet size is consistently 1452 bytes across multiple connections.
Why it's wrong here
Consistent packet size is not strong evidence alone; normal traffic can have similar sizes.
✓
The destination IP is listed in a threat intelligence feed as a known C2 server.
Why this is correct
Threat intelligence provides direct evidence of malicious intent.
Related concept
Read the scenario before looking for a memorised answer.
✓
The same source IP makes similar connections to the same destination IP every 60 seconds.
Why this is correct
Periodic connections are indicative of C2 beaconing.
Related concept
Read the scenario before looking for a memorised answer.
✗
The source IP also connected to multiple other external IPs on port 443 within the same hour.
Why it's wrong here
Multiple connections to different IPs could be normal web browsing.
✗
The traffic is using HTTPS (port 443) which is commonly used for covert channels.
Why it's wrong here
HTTPS is also used for legitimate purposes; alone it is not strong evidence.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between generic network behavior (like consistent packet sizes or common port usage) and specific indicators of compromise (like threat intelligence matches or periodic beaconing), trapping candidates who mistake normal traffic patterns for malicious activity.
Trap categories for this question
Similar concept trap
Consistent packet size is not strong evidence alone; normal traffic can have similar sizes.
Detailed technical explanation
How to think about this question
C2 traffic often exhibits periodic beaconing with consistent intervals (e.g., every 60 seconds) to maintain persistence and evade detection, as seen in malware like TrickBot or Emotet. Threat intelligence feeds aggregate IoCs such as IP addresses, domains, and hashes from sandbox analysis, sinkholes, and incident reports, providing a reliable external validation that a destination is malicious. The combination of regular timing (Option C) and a known malicious destination (Option B) creates a strong behavioral and signature-based indicator, aligning with the Cyber Kill Chain's 'Command & Control' phase.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security Monitoring — This question tests Security Monitoring — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The destination IP is listed in a threat intelligence feed as a known C2 server. — Option B is correct because a destination IP listed in a threat intelligence feed as a known C2 server directly indicates that the endpoint is associated with malicious command-and-control infrastructure. This external corroboration is strong evidence that the traffic is part of a C2 channel, as threat feeds aggregate confirmed indicators of compromise (IoCs) from multiple sources.
What should I do if I get this 200-201 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.