The answer is to block the attacker’s IP address at the firewall with a temporary drop rule. This is the best immediate action because the IPS was set to “alert” only, meaning it detected the SQL injection but did not stop the ongoing data exfiltration. By implementing a firewall rule to drop all traffic from 203.0.113.5, you sever the attacker’s active connection to the web server, halting the theft of customer PII from the database server while preserving forensic evidence for later analysis. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your understanding of containment priorities in the NIST incident response framework—specifically that blocking at the network edge is faster and less disruptive than taking the server offline. A common trap is choosing to shut down the web server, which destroys volatile evidence and impacts business operations. Remember the memory tip: “Alert means block at the edge—don’t pull the plug, drop the IP.”
200-201 Security Concepts Practice Question
This 200-201 practice question tests your understanding of security concepts. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are a SOC analyst monitoring traffic on a corporate network. The network uses a next-generation firewall (NGFW) with intrusion prevention system (IPS). You receive an alert that the IPS detected a SQL injection attempt against the internal web application server (10.0.1.10) from an external IP (203.0.113.5). The IPS action was set to "alert" only, not "drop". Further investigation shows that the web server logs indicate the SQL injection succeeded and data was exfiltrated to 203.0.113.5. The web application is a custom application developed in-house. The database server (10.0.1.20) contains customer PII. Which of the following is the BEST immediate action to contain the incident?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5
The immediate priority is to stop the active data exfiltration and prevent further exploitation. Since the IPS was configured to 'alert' only, it did not block the malicious traffic. Blocking the attacker's IP at the firewall with a temporary drop rule is the fastest way to sever the attacker's access to the web server and stop the ongoing data theft, containing the incident while preserving forensic evidence.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Apply a software patch to the web application to fix the SQL injection vulnerability
Why it's wrong here
Patching is important but takes time; it does not stop ongoing exfiltration.
✗
Restore the web server from a known good backup
Why it's wrong here
Restoring may remove the attacker's foothold but does not block the current exfiltration path.
✓
Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5
Why this is correct
This immediately cuts off the attacker's access and stops exfiltration.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Shut down the database server to prevent further data loss
Why it's wrong here
This may be too drastic and impacts business operations; also, data may already be exfiltrated.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between containment, eradication, and recovery actions, and the trap here is that candidates confuse a long-term fix (patching) or a disruptive action (shutting down the database) with the immediate need to stop active data exfiltration.
Detailed technical explanation
How to think about this question
In a containment strategy, the first action is to isolate the compromised asset from the attacker's network path. Firewall ACLs operate at the network layer (Layer 3/4) and can instantly drop all packets from a source IP, effectively terminating any TCP sessions in progress. This aligns with the NIST SP 800-61 incident response framework, which prioritizes containment before eradication or recovery. The 'alert-only' IPS action indicates a configuration gap that should be addressed later, but immediate containment requires a network-level block.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security Concepts — This question tests Security Concepts — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5 — The immediate priority is to stop the active data exfiltration and prevent further exploitation. Since the IPS was configured to 'alert' only, it did not block the malicious traffic. Blocking the attacker's IP at the firewall with a temporary drop rule is the fastest way to sever the attacker's access to the web server and stop the ongoing data theft, containing the incident while preserving forensic evidence.
What should I do if I get this 200-201 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A small retail company uses a cloud-based point-of-sale (POS) system. The IT manager receives an alert from the cloud provider that the POS application is generating an unusually high number of outbound connections to an IP address in a foreign country. The POS application is only supposed to communicate with the cloud provider's servers in the United States. The IT manager checks the POS terminal logs and finds that a new user account was created locally on the terminal with administrative privileges two days ago. The terminal does not have antivirus installed. What should the IT manager do first to contain the incident and prevent data loss?
easy
A.Reset the password for the new user account and disable it.
B.Install antivirus software on the terminal and run a full scan.
C.Contact the cloud provider to block the outbound IP address.
✓ D.Disconnect the POS terminal from the network immediately.
Why D: Disconnecting the POS terminal from the network immediately halts the suspected data exfiltration and prevents further loss.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.