hardMultiple ChoiceObjective-mapped
Cisco CyberOps Associate: Compromised Host Reconnaissance — Nmap Scans and Outbound HTTPS
You are a senior analyst in a SOC that monitors a large financial institution. The SIEM correlates events from firewalls, IDS, endpoints, and database servers. Over the past week, you have noticed multiple low-priority alerts from the IDS indicating 'ET SCAN NMAP -sS' scans from internal IP 10.0.0.50, which is a print server. The alerts occur at random times during business hours. The number of alerts has increased from 5 per day to 20 per day. The print server runs a standard OS and printer management software. No other alerts are triggered from that host. The firewall logs show outbound connections from the print server to IPs on the internet on port 443, which is abnormal for a print server. You check the printer management software and see no recent updates. The user of the print server, the IT administrator, reports no issues. What is your best course of action?
Quick Answer
The answer is to isolate the print server from the network and conduct a forensic investigation. This is the correct course of action because the print server at 10.0.0.50 is exhibiting classic signs of a compromised host performing network reconnaissance: the IDS is detecting internal Nmap SYN scans (ET SCAN NMAP -sS) from a device that should never scan, and the firewall logs show abnormal outbound HTTPS traffic to external IPs, which is a common indicator of command-and-control communication or data exfiltration. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your ability to correlate multiple low-priority alerts into a high-fidelity incident, distinguishing between a false positive and a true compromise. A common trap is to dismiss the alerts as benign because the user reports no issues, but the behavioral anomalies—especially the outbound HTTPS from a print server—override that report. Remember the memory tip: "Scan + Call Home = Isolate and Forensically Roam."
⚠ Common exam trap
Cisco often tests the candidate's ability to recognize that a combination of seemingly low-severity alerts (NMAP scans) and abnormal outbound traffic on a non-web server indicates a compromise, rather than dismissing them as false positives or tuning them out.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the print server from the network and conduct a forensic investigation
The print server at 10.0.0.50 is exhibiting multiple indicators of compromise: it is performing NMAP SYN scans (ET SCAN NMAP -sS) from an internal IP, and firewall logs show abnormal outbound HTTPS connections to internet IPs on port 443. These behaviors are inconsistent with a standard print server's role and suggest the host may be compromised, possibly acting as a pivot point for reconnaissance or command-and-control communication. Isolating the host and conducting a forensic investigation is the appropriate incident response step to contain the threat and determine the root cause before it can cause further damage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the alert threshold to reduce noise and continue monitoring
Why it's wrong here
Raising the threshold would suppress potentially critical alerts and delay response.
- ✗
Disable the printer service on the server and monitor for recurrence
Why it's wrong here
Disabling the service may not remove the underlying malware; the scanner and HTTPS behavior suggest a compromise.
- ✗
Dismiss the alerts as false positives because print servers often perform network discovery
Why it's wrong here
Print servers do not typically perform nmap scans and make outbound HTTPS connections; this is anomalous.
- ✓
Isolate the print server from the network and conduct a forensic investigation
Why this is correct
Isolation prevents further malicious activity, and forensic analysis can confirm compromise and identify the attack vector.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst for a medium-sized enterprise is monitoring the network using Cisco Stealthwatch. They notice a sudden spike in traffic originating from an internal host (IP 10.10.10.50) communicating with multiple external IP addresses on port 445 (SMB). The host is a Windows server that typically serves web applications on ports 80 and 443. The analyst checks the host's firewall logs and finds that Windows Firewall is disabled. The host's antivirus is up to date and no alerts were triggered. The traffic pattern shows multiple connection attempts to /24 subnets across the internet, each with a single packet per destination. Based on this behavior, what is the most likely issue?
hard- ✓ A.The host is infected with malware that is performing network reconnaissance.
- B.The host is part of a distributed vulnerability scanning initiative.
- C.The host is being used for a DDoS amplification attack.
- D.The host is legitimately scanning the internet for outdated SMB shares.
Why A: The traffic pattern—multiple connection attempts to /24 subnets across the internet, each with a single packet per destination—is classic behavior for network reconnaissance, specifically scanning for open SMB ports. The host's Windows Firewall being disabled and the lack of antivirus alerts indicate that the host is likely compromised and running malware that is performing this reconnaissance, as legitimate scanning or DDoS amplification would not exhibit this single-packet-per-destination pattern.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.