350-701 Cisco Firepower Access Control Policy Practice Question
A company is deploying a multi-tier application in a Cisco cloud security environment. The web servers must be accessible from the internet, but the database servers should only be reachable from the web servers. Which Cisco security controls should be used to enforce this?
⚠ Common exam trap
Candidates may incorrectly think that network ACLs or stateless rules are sufficient, but stateful inspection is required to track connection states for proper multi-tier segmentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a Cisco TrustSec security group tag (SGT) to web servers allowing HTTP/S from 0.0.0.0/0, and a separate SGT for databases allowing traffic only from the web server SGT
Cisco TrustSec Security Group Tags (SGTs) provide granular, scalable segmentation based on logical groups rather than IP addresses. They are stateful and can be used to allow traffic from web servers to database servers based on source SGT. This is more effective than stateless ACLs or subnet-level controls, and Cisco CloudLock is primarily a CASB, not for network segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Cisco ASA access-lists to allow inbound traffic to web servers from 0.0.0.0/0 and deny all traffic to database servers
Why it's wrong here
This approach uses stateless ACLs, which require manual rules for return traffic and do not provide stateful tracking, making management complex and error-prone.
- ✓
Assign a Cisco TrustSec security group tag (SGT) to web servers allowing HTTP/S from 0.0.0.0/0, and a separate SGT for databases allowing traffic only from the web server SGT
Why this is correct
Correct. Firepower access control rules are stateful and can reference source IPs or security zones to precisely allow only web server traffic to databases.
- ✗
Place web servers in a public subnet and database servers in a private subnet, and use a Cisco Firepower access control policy to block all traffic to the private subnet
Why it's wrong here
Placing resources in different zones is a good start, but blocking all traffic to the private zone would prevent legitimate database traffic from web servers. Instead, a permit rule should be added.
- ✗
Use Cisco CloudLock to restrict access to database servers based on source IP
Why it's wrong here
Incorrect. Cisco CloudLock is a cloud access security broker (CASB), not a network segmentation tool. It cannot enforce traffic flow between application tiers based on source IP in this manner.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.