easyMultiple SelectObjective-mapped
200-201 Practice Question: Which TWO of the following are common sources of…
Which TWO of the following are common sources of security events used in security monitoring?
⚠ Common exam trap
Cisco often tests the distinction between operational business data (HR, marketing) and actual security telemetry sources, expecting candidates to recognize that only logs from network infrastructure (firewalls, DNS servers, IDS/IPS) generate actionable security events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Firewall logs
Firewall logs (B) are a primary source of security events because they record allowed and denied traffic based on access control lists (ACLs), providing critical data on attempted intrusions, policy violations, and reconnaissance scans. DNS query logs (E) are equally vital as they capture domain resolution requests, enabling detection of malware command-and-control (C2) communication, DNS tunneling, and connections to known malicious domains. Both are standard inputs for SIEM systems and security monitoring platforms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Employee attendance records
Why it's wrong here
Attendance records are not a source of security events.
- ✓
Firewall logs
Why this is correct
Firewall logs provide information on allowed and denied connections.
- ✗
Marketing campaign results
Why it's wrong here
Marketing data is not relevant to security monitoring.
- ✗
Company newsletter subscriptions
Why it's wrong here
Newsletter data is not a security event source.
- ✓
DNS query logs
Why this is correct
DNS logs can reveal malicious domain lookups and C&C communications.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.