mediumMultiple Choice
Incident Containment for Data Exfiltration
You are a SOC analyst monitoring traffic on a corporate network. The network uses a next-generation firewall (NGFW) with intrusion prevention system (IPS). You receive an alert that the IPS detected a SQL injection attempt against the internal web application server (10.0.1.10) from an external IP (203.0.113.5). The IPS action was set to "alert" only, not "drop". Further investigation shows that the web server logs indicate the SQL injection succeeded and data was exfiltrated to 203.0.113.5. The web application is a custom application developed in-house. The database server (10.0.1.20) contains customer PII. Which of the following is the BEST immediate action to contain the incident?
Quick Answer
The answer is to block the attacker’s IP address at the firewall with a temporary drop rule. This is the best immediate action because the IPS was set to “alert” only, meaning it detected the SQL injection but did not stop the ongoing data exfiltration. By implementing a firewall rule to drop all traffic from 203.0.113.5, you sever the attacker’s active connection to the web server, halting the theft of customer PII from the database server while preserving forensic evidence for later analysis. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your understanding of containment priorities in the NIST incident response framework—specifically that blocking at the network edge is faster and less disruptive than taking the server offline. A common trap is choosing to shut down the web server, which destroys volatile evidence and impacts business operations. Remember the memory tip: “Alert means block at the edge—don’t pull the plug, drop the IP.”
⚠ Common exam trap
Cisco often tests the distinction between containment, eradication, and recovery actions, and the trap here is that candidates confuse a long-term fix (patching) or a disruptive action (shutting down the database) with the immediate need to stop active data exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5
The immediate priority is to stop the active data exfiltration and prevent further exploitation. Since the IPS was configured to 'alert' only, it did not block the malicious traffic. Blocking the attacker's IP at the firewall with a temporary drop rule is the fastest way to sever the attacker's access to the web server and stop the ongoing data theft, containing the incident while preserving forensic evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a software patch to the web application to fix the SQL injection vulnerability
Why it's wrong here
Patching removes the vulnerability but does not stop the active exfiltration or evict the attacker already inside. It is tempting as the permanent fix, yet patching is remediation performed after containment; the immediate action is blocking 203.0.113.5 and isolating the web server.
- ✗
Restore the web server from a known good backup
Why it's wrong here
Restoring from backup does not stop the ongoing attack or remove the attacker's access; the vulnerability and exfiltration channel persist. It is tempting as remediation, but restoration is a recovery action taken after containment, whereas the immediate priority is blocking the external IP and isolating the compromised web server.
- ✓
Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5
Why this is correct
Blocking 203.0.113.5 at the firewall and dropping its traffic immediately severs the exfiltration channel and prevents further exploitation, containing the active incident. The IPS was alert-only, so enforcement must be applied at the firewall to stop the ongoing attack.
- ✗
Shut down the database server to prevent further data loss
Why it's wrong here
Shutting down the database server halts exfiltration but also takes the customer PII service offline, and the attacker's access path through the web server remains open. It is tempting as a drastic containment step, yet blocking the malicious external IP and isolating the compromised web server contains the incident without destroying availability.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A small retail company uses a cloud-based point-of-sale (POS) system. The IT manager receives an alert from the cloud provider that the POS application is generating an unusually high number of outbound connections to an IP address in a foreign country. The POS application is only supposed to communicate with the cloud provider's servers in the United States. The IT manager checks the POS terminal logs and finds that a new user account was created locally on the terminal with administrative privileges two days ago. The terminal does not have antivirus installed. What should the IT manager do first to contain the incident and prevent data loss?
easy- A.Reset the password for the new user account and disable it.
- B.Install antivirus software on the terminal and run a full scan.
- C.Contact the cloud provider to block the outbound IP address.
- ✓ D.Disconnect the POS terminal from the network immediately.
Why D: Disconnecting the POS terminal from the network immediately halts the suspected data exfiltration and prevents further loss.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.