mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: Refer to the exhibit from a Cisco Firepower event
Exhibit
Event: Time: 2025-03-15 14:23:45 Priority: High Type: Intrusion Classification: Attempted User Privilege Gain Source IP: 10.0.0.100 Destination IP: 192.168.1.50 Source Port: 54321 Destination Port: 445 Protocol: TCP Message: "SMB2 Write Request with Unusual Pattern"
Refer to the exhibit from a Cisco Firepower event. Which action is most appropriate for the analyst?
⚠ Common exam trap
Cisco often tests the principle of 'investigate before act' — the trap here is that candidates see a security event and immediately choose a reactive action (block, disable, escalate) instead of the proper investigative step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate the source host for compromise
The exhibit shows a single intrusion event from a specific source IP to a destination IP. The most appropriate first step is to investigate the source host for compromise because the event indicates a potential exploit attempt originating from that host. Without additional context (e.g., multiple events, confirmed data exfiltration), escalating to law enforcement or blocking the IP is premature, and disabling the signature would blind the sensor to future threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escalate to law enforcement
Why it's wrong here
Incorrect. Escalation is premature without internal investigation.
- ✓
Investigate the source host for compromise
Why this is correct
Correct. The source is internal and the alert indicates suspicious activity, so the host may be compromised.
- ✗
Block the destination IP
Why it's wrong here
Incorrect. The destination is internal and blocking may disrupt services without evidence of compromise.
- ✗
Disable the intrusion signature
Why it's wrong here
Incorrect. Disabling signatures reduces security posture.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.