hardMultiple Choice
Cisco CyberOps Associate: Compromised Host Reconnaissance — Nmap Scans and Outbound HTTPS
You are a senior analyst in a SOC that monitors a large financial institution. The SIEM correlates events from firewalls, IDS, endpoints, and database servers. Over the past week, you have noticed multiple low-priority alerts from the IDS indicating 'ET SCAN NMAP -sS' scans from internal IP 10.0.0.50, which is a print server. The alerts occur at random times during business hours. The number of alerts has increased from 5 per day to 20 per day. The print server runs a standard OS and printer management software. No other alerts are triggered from that host. The firewall logs show outbound connections from the print server to IPs on the internet on port 443, which is abnormal for a print server. You check the printer management software and see no recent updates. The user of the print server, the IT administrator, reports no issues. What is your best course of action?
Quick Answer
The answer is to isolate the print server from the network and conduct a forensic investigation. This is the correct course of action because the print server at 10.0.0.50 is exhibiting classic signs of a compromised host performing network reconnaissance: the IDS is detecting internal Nmap SYN scans (ET SCAN NMAP -sS) from a device that should never scan, and the firewall logs show abnormal outbound HTTPS traffic to external IPs, which is a common indicator of command-and-control communication or data exfiltration. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your ability to correlate multiple low-priority alerts into a high-fidelity incident, distinguishing between a false positive and a true compromise. A common trap is to dismiss the alerts as benign because the user reports no issues, but the behavioral anomalies—especially the outbound HTTPS from a print server—override that report. Remember the memory tip: "Scan + Call Home = Isolate and Forensically Roam."
⚠ Common exam trap
Cisco often tests the candidate's ability to recognize that a combination of seemingly low-severity alerts (NMAP scans) and abnormal outbound traffic on a non-web server indicates a compromise, rather than dismissing them as false positives or tuning them out.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the print server from the network and conduct a forensic investigation
The print server at 10.0.0.50 is exhibiting multiple indicators of compromise: it is performing NMAP SYN scans (ET SCAN NMAP -sS) from an internal IP, and firewall logs show abnormal outbound HTTPS connections to internet IPs on port 443. These behaviors are inconsistent with a standard print server's role and suggest the host may be compromised, possibly acting as a pivot point for reconnaissance or command-and-control communication. Isolating the host and conducting a forensic investigation is the appropriate incident response step to contain the threat and determine the root cause before it can cause further damage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the alert threshold to reduce noise and continue monitoring
Why it's wrong here
Raising the threshold suppresses the very signal that matters: escalating internal scans plus anomalous outbound 443 traffic from a print server indicate compromise. Threshold tuning suits stable, benign noise. Here it delays containment, so the host should be isolated and investigated instead.
- ✗
Disable the printer service on the server and monitor for recurrence
Why it's wrong here
Disabling the printer service removes the printing role but leaves the compromised host running and its outbound command-and-control channel intact. Service removal suits decommissioning an unused role, not incident response. The host must be isolated and forensically examined before any service changes.
- ✗
Dismiss the alerts as false positives because print servers often perform network discovery
Why it's wrong here
Print servers do not perform NMAP SYN scans or open outbound port 443 sessions to internet hosts; treating this as a false positive ignores two correlated indicators of compromise. Dismissal fits confirmed benign scanner traffic from an authorised vulnerability-scanning appliance, which this is not.
- ✓
Isolate the print server from the network and conduct a forensic investigation
Why this is correct
Internal scanning from a print server, escalating alert volume, and abnormal outbound port 443 connections indicate compromise. Isolating the host preserves volatile evidence while halting exfiltration or lateral movement, and forensic investigation establishes scope and root cause before remediation or restoration.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst for a medium-sized enterprise is monitoring the network using Cisco Stealthwatch. They notice a sudden spike in traffic originating from an internal host (IP 10.10.10.50) communicating with multiple external IP addresses on port 445 (SMB). The host is a Windows server that typically serves web applications on ports 80 and 443. The analyst checks the host's firewall logs and finds that Windows Firewall is disabled. The host's antivirus is up to date and no alerts were triggered. The traffic pattern shows multiple connection attempts to /24 subnets across the internet, each with a single packet per destination. Based on this behavior, what is the most likely issue?
hard- ✓ A.The host is infected with malware that is performing network reconnaissance.
- B.The host is part of a distributed vulnerability scanning initiative.
- C.The host is being used for a DDoS amplification attack.
- D.The host is legitimately scanning the internet for outdated SMB shares.
Why A: The traffic pattern—multiple connection attempts to /24 subnets across the internet, each with a single packet per destination—is classic behavior for network reconnaissance, specifically scanning for open SMB ports. The host's Windows Firewall being disabled and the lack of antivirus alerts indicate that the host is likely compromised and running malware that is performing this reconnaissance, as legitimate scanning or DDoS amplification would not exhibit this single-packet-per-destination pattern.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.