mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: Refer to the exhibit
Exhibit
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"Microsoft RPC Service"; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; offset:0; depth:16; sid:1000001; rev:1;)
Refer to the exhibit. What does this Snort rule detect?
⚠ Common exam trap
Cisco often tests the distinction between protocol-specific signatures (e.g., 'this is SMB traffic') and exploit-specific signatures (e.g., 'this is a buffer overflow payload'), so the trap here is that candidates see 'SMB' in the rule and assume it's normal SMB traffic, missing the exploit pattern in the payload.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exploit code for a buffer overflow
The Snort rule detects a buffer overflow attempt by matching a specific pattern (e.g., a long string of 'A' characters or a shellcode pattern) in the payload, which is characteristic of exploit code targeting a vulnerable service. Buffer overflow exploits often send oversized data to trigger memory corruption, and Snort rules use content matching and byte_test to identify such anomalies. This rule likely targets a known overflow in a protocol like SMB or RPC, but the signature is specific to the exploit payload, not the protocol itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A NetBIOS name service query
Why it's wrong here
Incorrect. NetBIOS uses different ports and payloads.
- ✗
A vulnerability in Microsoft RPC
Why it's wrong here
Incorrect. The rule detects exploit attempts, not the vulnerability itself.
- ✗
Normal SMB traffic
Why it's wrong here
Incorrect. Normal SMB traffic does not contain this pattern.
- ✓
Exploit code for a buffer overflow
Why this is correct
Correct. The null-byte pattern is indicative of a buffer overflow exploit.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.