The answer is to enable SSH inspection using the 'inspect ssh' command in the global policy. This works because the ASA’s application layer inspection engine examines SSH control channel negotiations, allowing it to detect when SSH is being used to tunnel other protocols like HTTP—a technique commonly used to evade corporate firewall policies. Once detected, the ASA can block the tunneled traffic, effectively preventing users from bypassing security controls. On the Cisco SCOR 350-701 exam, this scenario tests your understanding of how application inspections differ from simple stateful filtering; a common trap is to assume that blocking port 22 alone stops SSH tunneling, but SSH inspection is required to catch protocol abuse within the encrypted session. Remember the memory tip: "Inspect SSH to catch the tunnel mess."
350-701 Security Concepts Practice Question
This 350-701 practice question tests your understanding of security concepts. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security administrator discovers that users are evading the corporate firewall by using SSH to tunnel HTTP traffic to external servers. Which action can be taken on a Cisco ASA firewall to detect and prevent this?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable SSH inspection using the 'inspect ssh' command in the global policy
Option B is correct because enabling SSH inspection with the 'inspect ssh' command on a Cisco ASA allows the firewall to monitor SSH control channel negotiations and detect when SSH is being used to tunnel other protocols (like HTTP). The ASA can then enforce policies to block such tunneling, preventing users from bypassing the corporate firewall.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Configure a dynamic PAT rule to limit the number of SSH sessions
Why it's wrong here
Limiting sessions does not detect tunneling content.
✓
Enable SSH inspection using the 'inspect ssh' command in the global policy
Why this is correct
SSH inspection allows the firewall to apply deep inspection and enforce policies on SSH traffic.
Related concept
Read the scenario before looking for a memorised answer.
✗
Create an access-list to block port 22 entirely
Why it's wrong here
Blocking port 22 would disrupt legitimate administrative SSH access.
✗
Implement SSL decryption to inspect the encrypted SSH payload
Why it's wrong here
SSH uses its own encryption, not SSL/TLS, so SSL decryption is ineffective.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that blocking port 22 is a valid solution, but the trap is that this would also block legitimate SSH access, whereas SSH inspection provides granular control without disrupting normal operations.
Detailed technical explanation
How to think about this question
SSH inspection on the ASA works by examining the SSH version exchange and key exchange messages to identify the tunneled application. When configured, the ASA can enforce application-layer policies, such as denying HTTP over SSH, by matching patterns in the SSH channel request. In real-world scenarios, this prevents users from using SSH as a proxy to access unauthorized web content while still allowing legitimate SSH management traffic.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security Concepts — This question tests Security Concepts — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Enable SSH inspection using the 'inspect ssh' command in the global policy — Option B is correct because enabling SSH inspection with the 'inspect ssh' command on a Cisco ASA allows the firewall to monitor SSH control channel negotiations and detect when SSH is being used to tunnel other protocols (like HTTP). The ASA can then enforce policies to block such tunneling, preventing users from bypassing the corporate firewall.
What should I do if I get this 350-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.