easyMultiple ChoiceObjective-mapped
200-201 Practice Question: Monitoring network traffic and notice a sudden…
You are monitoring network traffic and notice a sudden spike in outbound UDP traffic from a single internal host to various external IPs on port 123 (NTP). The traffic pattern shows a high volume of small packets. The host in question is a Linux server that does not run any NTP services. The IDS does not generate any alerts for this traffic. Which type of attack is most likely occurring?
⚠ Common exam trap
Cisco often tests the distinction between being a victim of amplification (receiving large responses) versus being the amplifier (sending queries), and candidates mistakenly assume the host is the victim when the outbound traffic indicates it is the source of the queries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The host is participating in an NTP amplification DDoS attack.
The sudden spike in outbound UDP traffic from a single internal host to multiple external IPs on port 123 (NTP) with small packets indicates the host is being used as a reflector in an NTP amplification DDoS attack. The attacker spoofs the victim's IP address and sends small queries to open NTP servers, which respond with large replies directed at the victim, but in this scenario the internal host is the one sending the queries (likely due to malware or misconfiguration), making it the amplifier. The lack of IDS alerts suggests the traffic matches normal NTP patterns, but the volume and destination diversity confirm the attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The host is participating in an NTP amplification DDoS attack.
Why this is correct
NTP amplification uses small queries to generate large responses; the outbound traffic is the queries.
- ✗
The host is scanning for open NTP servers.
Why it's wrong here
Scanning would show traffic to multiple ports, not just to port 123 on many IPs.
- ✗
Data exfiltration via NTP tunneling.
Why it's wrong here
NTP tunneling is possible but less common; the volume and pattern suggest amplification.
- ✗
The host is performing an NTP time synchronization query.
Why it's wrong here
The host does not run NTP services and the volume is too high for normal sync.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.