easyMultiple Select
200-201 Practice Question: Which TWO of the following are common sources of…
Which TWO of the following are common sources of security events used in security monitoring?
⚠ Common exam trap
Cisco often tests the distinction between operational business data (HR, marketing) and actual security telemetry sources, expecting candidates to recognize that only logs from network infrastructure (firewalls, DNS servers, IDS/IPS) generate actionable security events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Firewall logs
Firewall logs (B) are a primary source of security events because they record allowed and denied traffic based on access control lists (ACLs), providing critical data on attempted intrusions, policy violations, and reconnaissance scans. DNS query logs (E) are equally vital as they capture domain resolution requests, enabling detection of malware command-and-control (C2) communication, DNS tunneling, and connections to known malicious domains. Both are standard inputs for SIEM systems and security monitoring platforms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Employee attendance records
Why it's wrong here
Attendance records are HR administrative data, carrying no logon, process or network telemetry for detection engineering. It tempts because they are timestamped user events, but security monitoring draws on sources such as Windows event logs, firewalls, proxies and Microsoft Defender alerts, not payroll or rota systems.
- ✓
Firewall logs
Why this is correct
Firewall logs capture allowed and denied connection attempts with source, destination and port details, satisfying the security-event source requirement. They reveal scanning, policy violations and lateral movement attempts, providing essential network telemetry for security monitoring and incident investigation.
- ✗
Marketing campaign results
Why it's wrong here
Marketing campaign results are business analytics data, containing no host, network or authentication telemetry that a SIEM could correlate. It tempts because campaigns generate large event volumes, but the correct sources are things like firewalls, IDS/IPS, endpoints and Microsoft Entra ID sign-in logs.
- ✗
Company newsletter subscriptions
Why it's wrong here
Newsletter subscription lists are marketing contact data with no security-relevant telemetry, so no detection rule can consume them. It tempts because subscriptions generate mail-flow events, but monitoring sources are authentication logs, endpoint telemetry, firewalls and IDS/IPS alerts, not distribution lists.
- ✓
DNS query logs
Why this is correct
DNS query logs record domain resolution requests, exposing malicious domains, tunnelling and beaconing that indicate compromise, satisfying the security-event source requirement. They feed SIEM correlation alongside other telemetry to detect command-and-control and data exfiltration activity.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.