mediumMultiple SelectObjective-mapped
200-201 Practice Question: Which TWO actions are appropriate when analyzing…
Which TWO actions are appropriate when analyzing network traffic to identify a potential data exfiltration attempt?
⚠ Common exam trap
Cisco often tests the distinction between inbound and outbound traffic analysis, trapping candidates who forget that data exfiltration is an outbound activity, not an inbound one.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Look for connections to known malicious IP addresses or domains.
Connections to known malicious IP addresses or domains are a strong indicator of data exfiltration, as attackers often use command-and-control (C2) servers to receive stolen data. This aligns with the principle of threat intelligence-based detection, where security feeds (e.g., Cisco Talos, AlienVault OTX) provide reputation scores for external hosts. Identifying such outbound connections helps confirm that data is being sent to an adversary-controlled destination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Look for connections to known malicious IP addresses or domains.
Why this is correct
Connections to malicious destinations are suspicious.
- ✗
Clear the network logs to ensure accurate analysis.
Why it's wrong here
Clearing logs destroys evidence.
- ✗
Focus exclusively on inbound traffic from external sources.
Why it's wrong here
Exfiltration is outbound; inbound focus misses it.
- ✗
Immediately block all outbound traffic from the suspect host.
Why it's wrong here
This is a response action, not an analysis step.
- ✓
Identify unusually large outbound data transfers to external hosts.
Why this is correct
Large outbound data transfers can indicate exfiltration.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.