hardMultiple ChoiceObjective-mapped
200-201 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ! Output from show logging on Cisco IOS router Mar 1 10:00:00: %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.2(12345) -> 192.168.1.1(80), 1 packet Mar 1 10:00:01: %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.2(12346) -> 192.168.1.1(80), 1 packet Mar 1 10:00:02: %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.2(12347) -> 192.168.1.1(80), 1 packet Mar 1 10:00:03: %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.2(12348) -> 192.168.1.1(80), 1 packet
Refer to the exhibit. An analyst sees these log messages on a Cisco router. The source IP 10.0.0.2 is an internal server. What is the most likely explanation?
⚠ Common exam trap
Cisco often tests the distinction between inbound vs. outbound traffic and internal vs. external sources, so the trap here is assuming any denied traffic to a router must be an external attack, when the source IP clearly shows it is an internal host.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The internal server is trying to access the router's web interface, which is blocked by an ACL.
The log messages show repeated TCP connection attempts from internal server 10.0.0.2 to the router's IP on port 443 (HTTPS) and port 80 (HTTP), which are denied by an ACL. Since the source is an internal server and the destination is the router's own IP, this indicates the server is trying to reach the router's web interface, but the ACL is blocking those packets. Option C correctly identifies this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An external host is scanning the router.
Why it's wrong here
Source is internal IP 10.0.0.2.
- ✗
The router is under a brute-force attack on the HTTP server.
Why it's wrong here
The logs show denied packets, not multiple authentication attempts.
- ✓
The internal server is trying to access the router's web interface, which is blocked by an ACL.
Why this is correct
The router's own IP is being targeted on HTTP; this is likely management access.
- ✗
The router is infected with malware and generating traffic.
Why it's wrong here
The traffic is from the server, not the router.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.