mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: Monitoring a network segment that hosts a…
You are monitoring a network segment that hosts a public-facing web server. The NIDS alerts on a signature 'ET WEB_SERVER SQL Injection Attempt' triggered by traffic to the web server. The alert details show a GET request with the parameter 'id=1 OR 1=1'. The web server responds with a 200 OK and returns data. You check the web server logs and find that the application is a legacy system that does not use prepared statements. The security team has a policy to block all SQL injection attempts at the network level. However, you notice that the web server is also receiving legitimate traffic with similar patterns from internal monitoring tools that use dynamic queries. What is the most appropriate response?
⚠ Common exam trap
Cisco often tests the candidate's ability to distinguish between a true positive and a false positive in the context of security policy, where the trap is to immediately block the external IP (Option C) without considering that the alert might be a false positive or that a whitelist for legitimate internal traffic is the more appropriate first step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the internal monitoring tools' IP addresses to the whitelist and ensure that the network blocks the suspicious external request.
It balances security policy compliance with operational continuity. The internal monitoring tools' IP addresses should be whitelisted at the NIDS to prevent false positives, while the suspicious external request (which matches the SQL injection signature) should be blocked at the network level, as per policy. This approach ensures that legitimate internal traffic is not disrupted, while the external threat is mitigated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add the internal monitoring tools' IP addresses to the whitelist and ensure that the network blocks the suspicious external request.
Why this is correct
Whitelisting internal tools reduces false positives; blocking external malicious traffic maintains security.
- ✗
Disable the SQL injection signature for the web server because it causes false positives.
Why it's wrong here
Disabling removes protection against real attacks.
- ✗
Immediately block all traffic from the external source IP that triggered the alert.
Why it's wrong here
Blocking the IP may be too narrow and does not address the internal false positives.
- ✗
Request that the internal monitoring tools stop using dynamic queries, and leave the signature as is.
Why it's wrong here
This may not be feasible and does not address current false positives.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.