The immediate action should be to block the external IP 185.220.101.10 on the firewall and initiate incident response for the router, as this stops the ongoing data exfiltration while preserving the compromised device for forensic analysis. This is correct because the branch router is sending 2 GB of NTP traffic to a known malicious IP during off-hours, and since the branch uses a local time server, this abnormal NTP traffic strongly indicates data tunneling or a covert channel for exfiltration. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your ability to prioritize containment over investigation—a common trap is to first check logs or contact the branch manager, which wastes time while data leaks. Remember the containment action for router communicating with malicious IP must be immediate: cut the network path, then escalate. Memory tip: "Block first, ask questions later"—the firewall is your emergency shut-off valve.
200-201 Security Monitoring Practice Question
This 200-201 practice question tests your understanding of security monitoring. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are an analyst in a SOC that monitors a retail company with multiple branch offices. The company uses VPN connections between branches. The SIEM reports that a branch office router (IP 10.99.0.1) has been sending large amounts of data to an external IP 185.220.101.10 on port 123 (NTP) during off-hours. The NTP traffic is abnormal because the branch uses a local time server. The amount of data sent is 2 GB over 8 hours. The router logs show normal administrative traffic. The branch manager reports no issues. You check threat intelligence and find that 185.220.101.10 is a known malicious IP associated with data exfiltration. What should be your immediate response?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the external IP 185.220.101.10 on the firewall and initiate incident response for the router
Option C is correct because the branch router is sending 2 GB of NTP traffic to a known malicious IP (185.220.101.10) during off-hours, which is a strong indicator of data exfiltration using NTP (often via tunneling or covert channels). The immediate response should be to block the external IP on the firewall to stop the data flow and initiate incident response to investigate the compromised router, as the traffic is abnormal (branch uses a local time server) and the IP is associated with exfiltration.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Disable NTP service on the branch router
Why it's wrong here
Disabling NTP could disrupt time synchronization across the branch network.
✗
Notify the CISO and wait for further instructions
Why it's wrong here
Immediate containment is needed; waiting could allow more data to be stolen.
✓
Block the external IP 185.220.101.10 on the firewall and initiate incident response for the router
Why this is correct
Blocking the IP stops the exfiltration, and investigating the router determines if it is compromised.
Related concept
Read the scenario before looking for a memorised answer.
✗
Contact the branch manager to confirm if any scheduled backups are running
Why it's wrong here
The manager reported no issues; relying on them may waste time while exfiltration continues.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the candidate's ability to prioritize immediate containment (blocking the malicious IP) over administrative or investigative delays, and the trap here is that candidates may choose to disable the service (Option A) without realizing that the exfiltration is already in progress and must be stopped at the network level first.
Detailed technical explanation
How to think about this question
NTP (Network Time Protocol) uses UDP port 123 and can be abused for data exfiltration via techniques like NTP tunneling or using the NTP control messages (mode 6/7) to encapsulate data. The 2 GB of traffic over 8 hours (approximately 580 Kbps) is far beyond normal NTP synchronization traffic (typically a few hundred bytes per poll), indicating a covert channel or data transfer. In real-world scenarios, attackers compromise routers and use legitimate services like NTP to blend exfiltration with normal traffic, making it essential to correlate with threat intelligence and block the destination IP immediately.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the 200-201 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security Monitoring — This question tests Security Monitoring — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Block the external IP 185.220.101.10 on the firewall and initiate incident response for the router — Option C is correct because the branch router is sending 2 GB of NTP traffic to a known malicious IP (185.220.101.10) during off-hours, which is a strong indicator of data exfiltration using NTP (often via tunneling or covert channels). The immediate response should be to block the external IP on the firewall to stop the data flow and initiate incident response to investigate the compromised router, as the traffic is abnormal (branch uses a local time server) and the IP is associated with exfiltration.
What should I do if I get this 200-201 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.