mediumMultiple ChoiceObjective-mapped
Incident Containment for Data Exfiltration
You are a SOC analyst monitoring traffic on a corporate network. The network uses a next-generation firewall (NGFW) with intrusion prevention system (IPS). You receive an alert that the IPS detected a SQL injection attempt against the internal web application server (10.0.1.10) from an external IP (203.0.113.5). The IPS action was set to "alert" only, not "drop". Further investigation shows that the web server logs indicate the SQL injection succeeded and data was exfiltrated to 203.0.113.5. The web application is a custom application developed in-house. The database server (10.0.1.20) contains customer PII. Which of the following is the BEST immediate action to contain the incident?
Quick Answer
The answer is to block the attacker’s IP address at the firewall with a temporary drop rule. This is the best immediate action because the IPS was set to “alert” only, meaning it detected the SQL injection but did not stop the ongoing data exfiltration. By implementing a firewall rule to drop all traffic from 203.0.113.5, you sever the attacker’s active connection to the web server, halting the theft of customer PII from the database server while preserving forensic evidence for later analysis. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your understanding of containment priorities in the NIST incident response framework—specifically that blocking at the network edge is faster and less disruptive than taking the server offline. A common trap is choosing to shut down the web server, which destroys volatile evidence and impacts business operations. Remember the memory tip: “Alert means block at the edge—don’t pull the plug, drop the IP.”
⚠ Common exam trap
Cisco often tests the distinction between containment, eradication, and recovery actions, and the trap here is that candidates confuse a long-term fix (patching) or a disruptive action (shutting down the database) with the immediate need to stop active data exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5
The immediate priority is to stop the active data exfiltration and prevent further exploitation. Since the IPS was configured to 'alert' only, it did not block the malicious traffic. Blocking the attacker's IP at the firewall with a temporary drop rule is the fastest way to sever the attacker's access to the web server and stop the ongoing data theft, containing the incident while preserving forensic evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a software patch to the web application to fix the SQL injection vulnerability
Why it's wrong here
Patching is important but takes time; it does not stop ongoing exfiltration.
- ✗
Restore the web server from a known good backup
Why it's wrong here
Restoring may remove the attacker's foothold but does not block the current exfiltration path.
- ✓
Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5
Why this is correct
This immediately cuts off the attacker's access and stops exfiltration.
- ✗
Shut down the database server to prevent further data loss
Why it's wrong here
This may be too drastic and impacts business operations; also, data may already be exfiltrated.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A small retail company uses a cloud-based point-of-sale (POS) system. The IT manager receives an alert from the cloud provider that the POS application is generating an unusually high number of outbound connections to an IP address in a foreign country. The POS application is only supposed to communicate with the cloud provider's servers in the United States. The IT manager checks the POS terminal logs and finds that a new user account was created locally on the terminal with administrative privileges two days ago. The terminal does not have antivirus installed. What should the IT manager do first to contain the incident and prevent data loss?
easy- A.Reset the password for the new user account and disable it.
- B.Install antivirus software on the terminal and run a full scan.
- C.Contact the cloud provider to block the outbound IP address.
- ✓ D.Disconnect the POS terminal from the network immediately.
Why D: Disconnecting the POS terminal from the network immediately halts the suspected data exfiltration and prevents further loss.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.