hardMultiple ChoiceObjective-mapped
200-201 Practice Question: A security analyst at a mid-sized company that…
You are a security analyst at a mid-sized company that uses a mix of on-premises servers and cloud services. The company's security policy requires all sensitive data to be encrypted at rest and in transit, and all access to be logged and monitored. Recently, the company experienced a data breach where an attacker exfiltrated a database containing customer PII. The investigation revealed that the attacker gained access using a compromised VPN account that had been inactive for 6 months. The account belonged to a former employee who left the company but the account was never disabled. The VPN logs show that the account was used from an unusual IP address, but no alert was triggered because the account was not on any watchlist. The breach occurred over a weekend when the security team was not monitoring. Which of the following would have most effectively prevented this breach?
⚠ Common exam trap
Cisco often tests the distinction between preventive and detective controls, and the trap here is that candidates choose a detective solution (like SIEM or log review) because it sounds more technical, overlooking the fundamental preventive control of account lifecycle management that would have stopped the breach at its source.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automate the de-provisioning of user accounts upon employee termination.
The root cause of the breach was that the former employee's VPN account remained active after termination, allowing the attacker to use it. Automating the de-provisioning of user accounts upon employee termination (Option D) directly addresses this by ensuring that accounts are disabled or removed as part of the offboarding process, eliminating the attack vector entirely. This aligns with the principle of least privilege and identity lifecycle management, which are foundational to access control policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a SIEM with anomaly detection for unusual VPN login locations.
Why it's wrong here
This would detect but not prevent; the attacker would still gain access before an alert is generated.
- ✗
Implement multi-factor authentication on all VPN accounts.
Why it's wrong here
MFA would have helped if the account was active, but the account was unused and could have been used with MFA if the attacker had the second factor? Actually, MFA would have blocked the attacker if the second factor was not available. However, the account was disabled? Actually, it was not disabled. But MFA is a strong control; however, the scenario says the account was compromised, possibly with stolen credentials including MFA token? The question asks 'most effectively prevented' given the root cause. The account was inactive, so the best prevention is disabling it.
- ✗
Increase the frequency of log reviews to daily.
Why it's wrong here
Even if logs were reviewed daily, the breach occurred over a weekend, and the account would still be active.
- ✓
Automate the de-provisioning of user accounts upon employee termination.
Why this is correct
This directly addresses the root cause: the account should have been disabled when the employee left.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.