350-701 Network Security Practice Question
A network architect is designing a DMZ for a web server farm. The ASA firewall will have three interfaces: inside (level 100), DMZ (level 50), and outside (level 0). They want to allow HTTP traffic from the internet to the DMZ web servers and also allow the web servers to initiate connections to the inside for database updates. What is the minimal ACL configuration to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ACL on outside interface inbound permitting HTTP to DMZ; ACL on DMZ interface inbound permitting database traffic to inside.
Traffic from higher to lower security is implicitly allowed, so from inside (100) to DMZ (50) is allowed by default. Traffic from DMZ (50) to inside (100) is blocked by default, so an ACL on the DMZ interface inbound (or inside interface outbound) is needed to permit the database updates. For traffic from outside (0) to DMZ (50), it is from lower to higher, so an ACL on the outside interface inbound is needed to permit HTTP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ACL on outside interface inbound permitting HTTP to DMZ; ACL on inside interface inbound permitting database traffic from DMZ.
Why it's wrong here
Incorrect. Database traffic from DMZ to inside is from lower to higher; ACL on inside inbound would not be evaluated for traffic from DMZ (unless global).
- ✗
No ACL needed because traffic from higher to lower is implicitly allowed.
Why it's wrong here
Incorrect. Traffic from lower to higher (outside to DMZ) is blocked by default.
- ✗
ACL on inside interface inbound permitting HTTP to DMZ; ACL on DMZ interface inbound permitting database traffic to inside.
Why it's wrong here
Incorrect. HTTP from outside to DMZ would not be permitted because no ACL on outside.
- ✓
ACL on outside interface inbound permitting HTTP to DMZ; ACL on DMZ interface inbound permitting database traffic to inside.
Why this is correct
Correct. Allows inbound HTTP from outside to DMZ, and outbound database from DMZ to inside.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.