200-201 Security Monitoring Practice Question
During a security monitoring exercise, an analyst observes a series of NetFlow records showing a single internal host communicating with multiple external IP addresses on port 445 (SMB) within a short time window. The traffic volumes are small but consistent. Which THREE of the following should the analyst consider as possible explanations? (Choose three.)
⚠ Common exam trap
Cisco often tests the distinction between normal SMB file sharing (which involves larger, sustained transfers to known hosts) and the pattern of small, consistent flows to many random IPs, which indicates scanning or propagation activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The host is infected with malware that propagates via SMB (e.g., EternalBlue).
SMB port 445 is a common vector for worm-like malware such as EternalBlue (MS17-010), which spreads by sending crafted SMB packets to random external IPs. The small, consistent traffic volumes and multiple external destinations match the behavior of a host scanning or propagating to new targets rather than normal file transfers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The host is streaming video content.
Why it's wrong here
Streaming video typically uses HTTP/HTTPS or RTSP, not SMB.
- ✗
The host is engaging in normal internal file sharing with external partners.
Why it's wrong here
Internal file sharing typically involves known servers, not many random external IPs.
- ✓
The host is infected with malware that propagates via SMB (e.g., EternalBlue).
Why this is correct
Worms that spread via SMB often contact many external IPs to find vulnerable targets.
- ✓
The host is exfiltrating small amounts of data to multiple external destinations via SMB.
Why this is correct
Attackers may use SMB to exfiltrate data in small chunks to avoid detection.
- ✓
The host is scanning the internet for SMB vulnerabilities.
Why this is correct
Port scanning often targets many IPs on a single port to find vulnerable services.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.