easyMultiple Choice
200-201 A security analyst at a mid-sized company Practice Question
You are a security analyst at a mid-sized company. The company uses a SIEM to collect logs from firewalls, IDS, and servers. Recently, the SIEM generated an alert for a potential brute-force attack against the company's VPN server. The alert is based on a correlation rule that triggers when more than 30 failed authentication attempts from a single source IP occur within 10 minutes. You investigate and see that the source IP is 203.0.113.50, which is a known IP address of a partner company that uses the VPN for remote access. The failed attempts are all from the same username 'john.doe'. You also notice that the attempts are happening every 5 seconds, exactly 6 attempts per minute. The partner company has a policy that locks accounts after 3 failed attempts. Based on this scenario, what is the most likely cause of the alert?
⚠ Common exam trap
Cisco often tests the distinction between human behavior and automated patterns by including precise timing data; the trap here is that candidates focus on the source IP being a 'known partner' and assume compromise or user error, ignoring the mechanical regularity that points to a script.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A script or automated process at the partner site is misconfigured and repeatedly trying to authenticate with an incorrect password.
The alert is triggered by a correlation rule that detects more than 30 failed authentication attempts from a single source IP within 10 minutes. The observed pattern—exactly 6 attempts per minute, every 5 seconds—is highly regular and mechanical, which is characteristic of an automated script or misconfigured process, not human behavior. Since the partner company locks accounts after 3 failed attempts, a human user would be locked out quickly and could not sustain 30+ attempts; only a script ignoring the lockout policy or using a cached incorrect password could produce this pattern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user 'john.doe' has forgotten his password and is repeatedly trying to log in.
Why it's wrong here
The attempts arrive every 5 seconds with machine-like regularity, and the partner's lockout after three failures would have stopped a human retrying manually. It is tempting because a forgotten password is the commonest cause of failed logins, and it would fit if the attempts were irregular and few.
- ✓
A script or automated process at the partner site is misconfigured and repeatedly trying to authenticate with an incorrect password.
Why this is correct
The exact timing and same username point to a script; the lockout policy would lock the account after 3 attempts, but the script may be retrying from the same source, causing the SIEM alert before the lockout.
- ✗
A man-in-the-middle attack is replaying captured authentication packets.
Why it's wrong here
A man-in-the-middle replay would resend captured authentication packets, not generate fresh failed attempts for one username at fixed 5-second intervals. It is tempting because replay attacks also produce repeated authentication traffic, and it would be correct if identical captured credentials were being reused.
- ✗
The partner's account 'john.doe' has been compromised and an attacker is attempting to gain access.
Why it's wrong here
Compromise would show attempts against many accounts or successful logins, not one username failing every 5 seconds in a fixed pattern. It is tempting because brute-force alerts often indicate credential attacks, and it would be correct if the source IP were unknown and the target accounts varied.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.