mediumMultiple ChoiceObjective-mapped
350-701 Practice Question: A company has a Cisco ASA firewall configured…
A company has a Cisco ASA firewall configured with multiple access-lists applied to the outside interface. The security team is investigating reports that legitimate HTTPS traffic to a public web server located on a DMZ is intermittently being blocked. The firewall configuration includes an ACL that permits traffic to the web server's IP address on TCP 443, but also includes a general deny rule for all other traffic. The engineer notices that the permit rule is placed after a deny rule that blocks traffic from a specific source subnet that is used by internal users for testing. The internal users report that they can access the web server, but external users sometimes experience timeouts. What is the most likely cause of the intermittent blocking?
⚠ Common exam trap
Cisco often tests the concept of ACL sequential processing and the importance of rule order, where candidates mistakenly assume that a permit rule later in the list will override an earlier deny rule, or that the ASA uses a 'best-match' approach like a routing table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The permit rule for HTTPS is not hitting because traffic is being matched by a preceding deny rule.
The most likely cause is that the permit rule for HTTPS (TCP 443) is placed after a deny rule that blocks traffic from a specific source subnet. Since ACLs on a Cisco ASA are processed sequentially from top to bottom, if a packet matches the earlier deny rule, it will be dropped before reaching the permit rule. This explains why external users (who may be sourced from the blocked subnet or whose traffic is inadvertently matched by the deny rule due to overlapping or misconfigured source conditions) experience intermittent timeouts, while internal users from a different subnet are not affected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The permit rule for HTTPS is not hitting because traffic is being matched by a preceding deny rule.
Why this is correct
If a deny rule earlier in the ACL matches the traffic, the permit rule is never evaluated, causing blocking.
- ✗
The external users are hitting the firewall's connection limit.
Why it's wrong here
Connection limits would affect both internal and external users equally, not just external.
- ✗
The ASA is performing NAT incorrectly for the web server traffic.
Why it's wrong here
NAT issues would affect all users consistently, not cause intermittent blocking for external only.
- ✗
The ASA is experiencing high CPU utilization causing packet drops.
Why it's wrong here
High CPU could cause drops, but intermittent block for only external users and not internal suggests an ACL ordering issue.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.