200-201 Security Monitoring Practice Question
During a security incident, a SOC analyst reviews NetFlow records and notices a single internal host communicating with a remote server on TCP port 443, sending 50 MB of data in 5 minutes, while the usual baseline for that host is 1 MB per hour. Which type of activity is most likely indicated?
⚠ Common exam trap
Cisco often tests the distinction between volumetric anomalies (like data exfiltration) and behavioral anomalies (like scans or DoS), and the trap here is that candidates may confuse a high outbound data volume with a DoS attack, forgetting that DoS targets inbound traffic to a victim, not outbound bulk transfer from a single host.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data exfiltration
The sudden spike in outbound data volume from a single internal host to a remote server over TCP port 443 (HTTPS) far exceeds the established baseline of 1 MB per hour, reaching 50 MB in just 5 minutes. This anomalous behavior is a classic indicator of data exfiltration, where an attacker is using encrypted HTTPS traffic to stealthily transfer stolen data out of the network without triggering typical signature-based alerts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Denial of service attack
Why it's wrong here
DoS attacks generate high traffic but typically to many destinations or with specific patterns, not a single external IP with large data uploads.
- ✗
Port scan activity
Why it's wrong here
Port scans involve connections to many ports on many hosts, not large data transfers.
- ✓
Data exfiltration
Why this is correct
Unusually high outbound data volume, especially to a single external IP, is a strong indicator of data theft.
- ✗
Normal web browsing traffic
Why it's wrong here
The volume is far above the host's baseline; normal browsing would not produce such a spike.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.