mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: A security analyst at a healthcare organization
You are a security analyst at a healthcare organization. The organization uses Cisco Stealthwatch for network visibility and a SIEM for event correlation. You receive an alert that a medical records database server (IP 10.0.3.20) is communicating with an external IP (198.51.100.100) on port 22 (SSH) at 2:00 AM. The database server should have no outbound SSH connections; only remote administration is allowed from a management subnet via VPN. You check Stealthwatch and see that the connection duration is 30 minutes and the volume of data transferred is 500 MB. The database server logs show no local account logins at that time. The firewall logs show that the connection was initiated from the database server. The incident response team has been alerted. What is the most likely scenario and your immediate action?
⚠ Common exam trap
Cisco often tests the candidate's ability to prioritize containment over investigation in active incident response scenarios, trapping those who choose to investigate first (Option C) instead of immediately isolating the compromised asset.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the external IP 198.51.100.100 on the firewall and isolate the database server
The database server is initiating an outbound SSH connection to an unknown external IP at an anomalous time, transferring 500 MB of data—far beyond typical administrative traffic. This behavior, combined with no local account logins and the server's policy prohibiting outbound SSH, strongly indicates compromise (e.g., an attacker using SSH for data exfiltration). Immediate isolation and blocking the external IP are critical to contain the threat and prevent further data loss, aligning with incident response best practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the database administrator password immediately
Why it's wrong here
Password change is insufficient if the attacker has a remote access tool installed.
- ✗
Check if the SSH connection was an authorized remote administration session
Why it's wrong here
The connection originated from the database server, not from an admin; it is likely malicious.
- ✗
Investigate the database server logs for signs of compromise before taking action
Why it's wrong here
Containment must come before investigation to stop ongoing data loss.
- ✓
Block the external IP 198.51.100.100 on the firewall and isolate the database server
Why this is correct
Blocking the IP stops the exfiltration, and isolation prevents further compromise.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.