hardMultiple ChoiceObjective-mapped
200-201 Practice Question: Given the syslog message, which additional data…
Exhibit
Refer to the exhibit. <syslog> Sep 15 14:35:22 firepower.cisco.com %FTD-4-425003: Intrusion event at interface inside, policy name mypolicy, action drop, rule ID 12345, source IP 10.0.0.5, dest IP 203.0.113.10, classifier "MALWARE-CNC", priority 3, sig ID 50000, rev 2, message "Malware CnC Traffic Detected" </syslog>
Given the syslog message, which additional data would best confirm the event as a true positive?
⚠ Common exam trap
Cisco often tests the difference between network-layer metadata (NetFlow) and application-layer logs (URL filtering), trapping candidates who think flow data alone can confirm a malicious event.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
URL filtering logs for traffic to 203.0.113.10
The syslog message likely indicates a security event such as a connection to a known malicious IP (203.0.113.10). URL filtering logs provide the specific HTTP/HTTPS request details (e.g., URI, user agent, category) that can confirm whether the traffic was intentional and malicious, rather than a false positive from a benign service or misconfiguration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPN logs for user authentication
Why it's wrong here
VPN logs are unrelated to CnC detection.
- ✓
URL filtering logs for traffic to 203.0.113.10
Why this is correct
URL filtering can reveal if the destination is a known malicious site.
- ✗
Antivirus logs on 10.0.0.5
Why it's wrong here
Antivirus logs may not capture network-based CnC activity.
- ✗
NetFlow data showing other connections from 10.0.0.5
Why it's wrong here
NetFlow shows patterns but not malicious intent.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.