mediumMultiple ChoiceObjective-mapped
350-701 Deploying a new ASA firewall in a DMZ design Practice Question
A company is deploying a new ASA firewall in a DMZ design. They need to allow web traffic from the internet to a web server in the DMZ, while also permitting outbound traffic from the DMZ to the internet for software updates. Which access control approach best meets these requirements with minimal risk?
⚠ Common exam trap
Cisco often tests the misconception that simply allowing 'established' connections is sufficient for outbound traffic, but the trap here is that the question explicitly requires outbound HTTP/HTTPS for updates, which must be explicitly permitted and inspected, not just allowed as return traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an ACL that permits established connections inbound, and allows HTTP/HTTPS from DMZ to internet with application inspection.
It uses the 'established' keyword to allow return traffic for inbound web connections while explicitly permitting outbound HTTP/HTTPS with application inspection. This minimizes risk by not blindly allowing all outbound traffic, and inspection ensures protocol compliance and stateful tracking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an ACL that permits all inbound and outbound traffic between DMZ and internet.
Why it's wrong here
Overly permissive, defeats purpose of DMZ segmentation.
- ✓
Create an ACL that permits established connections inbound, and allows HTTP/HTTPS from DMZ to internet with application inspection.
Why this is correct
Balances security and functionality by inspecting traffic and limiting outbound to necessary services.
- ✗
Create an ACL that permits inbound web traffic to the DMZ server and permits all outbound traffic from DMZ with no inspection.
Why it's wrong here
Allowing all outbound without inspection increases risk of malware exfiltration.
- ✗
Create an ACL that permits inbound web traffic to the DMZ server and denies all outbound traffic from DMZ.
Why it's wrong here
Denies software updates, breaking functionality.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.