mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: An analyst in a SOC that monitors a retail…
You are an analyst in a SOC that monitors a retail company with multiple branch offices. The company uses VPN connections between branches. The SIEM reports that a branch office router (IP 10.99.0.1) has been sending large amounts of data to an external IP 185.220.101.10 on port 123 (NTP) during off-hours. The NTP traffic is abnormal because the branch uses a local time server. The amount of data sent is 2 GB over 8 hours. The router logs show normal administrative traffic. The branch manager reports no issues. You check threat intelligence and find that 185.220.101.10 is a known malicious IP associated with data exfiltration. What should be your immediate response?
⚠ Common exam trap
Cisco often tests the candidate's ability to prioritize immediate containment (blocking the malicious IP) over administrative or investigative delays, and the trap here is that candidates may choose to disable the service (Option A) without realizing that the exfiltration is already in progress and must be stopped at the network level first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the external IP 185.220.101.10 on the firewall and initiate incident response for the router
The branch router is sending 2 GB of NTP traffic to a known malicious IP (185.220.101.10) during off-hours, which is a strong indicator of data exfiltration using NTP (often via tunneling or covert channels). The immediate response should be to block the external IP on the firewall to stop the data flow and initiate incident response to investigate the compromised router, as the traffic is abnormal (branch uses a local time server) and the IP is associated with exfiltration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable NTP service on the branch router
Why it's wrong here
Disabling NTP could disrupt time synchronization across the branch network.
- ✗
Notify the CISO and wait for further instructions
Why it's wrong here
Immediate containment is needed; waiting could allow more data to be stolen.
- ✓
Block the external IP 185.220.101.10 on the firewall and initiate incident response for the router
Why this is correct
Blocking the IP stops the exfiltration, and investigating the router determines if it is compromised.
- ✗
Contact the branch manager to confirm if any scheduled backups are running
Why it's wrong here
The manager reported no issues; relying on them may waste time while exfiltration continues.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.