The answer is to move rule 3 (block guest to data center) above rule 1 (allow any). This is correct because Cisco Firepower processes access control rules in strict top-down order, and rule 1’s “allow any any” matches all traffic first, including the guest-to-data-center communication, before rule 3 can ever be evaluated. By reordering the ACL so the specific deny precedes the broad allow, the block action takes immediate effect without disrupting other legitimate flows. On the Cisco SCOR 350-701 exam, this scenario tests your understanding of rule ordering and the critical principle that specific deny rules must be placed above any general allow rules to be effective—a common trap where candidates mistakenly add a new deny rule at the bottom, forgetting it will never be reached. A useful memory tip: “Specific denies must rise above the any any tide.”
350-701 Network Security Practice Question
This 350-701 practice question tests your understanding of network security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A multinational company has deployed a Cisco Firepower 4100 series device as the perimeter firewall. The network consists of multiple internal segments: a corporate LAN (192.168.1.0/24), a data center (10.10.0.0/16), and a guest wireless network (172.16.0.0/16). The firewall is configured with the following access control policy rules:
1. Allow from any to any (for testing, but currently enabled)
2. Allow from corporate LAN to data center (destination ports TCP/443, TCP/8443)
3. Block from guest wireless to data center
4. Allow from any to internet (destination any)
Recently, the security team discovered that a host in the guest network (172.16.5.50) is communicating with a server in the data center (10.10.10.100) on TCP port 443. The security team wants to immediately block this traffic without affecting other legitimate communications. Which action should be taken first?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Clue: "immediately / without restart"
Why it matters: Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.
Move rule 3 (block guest to data center) above rule 1 (allow all)
This ensures the block rule is evaluated before the allow rule, stopping the traffic.
B
Modify rule 2 to include a deny for the guest subnet
Why wrong: Rule 2 is for corporate LAN to data center; modifying it would not affect guest traffic.
C
Change rule 4 to block all traffic from guest network
Why wrong: This would block all guest internet access, which is not desired.
D
Add a new rule after rule 4 to block the specific traffic
Why wrong: A new rule after rule 4 would still be after the allow rule (rule 1), so it would not match because the traffic is already allowed by rule 1.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move rule 3 (block guest to data center) above rule 1 (allow all)
Rule 1 is an 'allow any any' rule placed above rule 3, which is supposed to block guest-to-data-center traffic. Because Cisco Firepower processes access control rules in top-down order, rule 1 matches and permits the traffic before rule 3 can be evaluated. Moving rule 3 above rule 1 ensures the block action is applied first, immediately stopping the unwanted communication without altering other rules.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Move rule 3 (block guest to data center) above rule 1 (allow all)
Why this is correct
This ensures the block rule is evaluated before the allow rule, stopping the traffic.
Clue confirmation
The clue words "first", "immediately / without restart" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Modify rule 2 to include a deny for the guest subnet
Why it's wrong here
Rule 2 is for corporate LAN to data center; modifying it would not affect guest traffic.
✗
Change rule 4 to block all traffic from guest network
Why it's wrong here
This would block all guest internet access, which is not desired.
✗
Add a new rule after rule 4 to block the specific traffic
Why it's wrong here
A new rule after rule 4 would still be after the allow rule (rule 1), so it would not match because the traffic is already allowed by rule 1.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the concept that a default 'allow any' rule placed above more specific deny rules will negate those denies, and candidates mistakenly think adding a new rule or modifying an existing rule later in the policy will override the earlier match.
Detailed technical explanation
How to think about this question
Cisco Firepower Threat Defense (FTD) access control policies use a first-match model: the first rule that matches the traffic is applied, and subsequent rules are ignored. This is identical to classic ASA ACL behavior but with additional inspection capabilities. In a real-world scenario, a 'testing' rule left enabled is a common misconfiguration that can silently bypass security controls, emphasizing the need for rigorous rule auditing and placement discipline.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Network Security — This question tests Network Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Move rule 3 (block guest to data center) above rule 1 (allow all) — Rule 1 is an 'allow any any' rule placed above rule 3, which is supposed to block guest-to-data-center traffic. Because Cisco Firepower processes access control rules in top-down order, rule 1 matches and permits the traffic before rule 3 can be evaluated. Moving rule 3 above rule 1 ensures the block action is applied first, immediately stopping the unwanted communication without altering other rules.
What should I do if I get this 350-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first", "immediately / without restart". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a Cisco ASA firewall configured with multiple access-lists applied to the outside interface. The security team is investigating reports that legitimate HTTPS traffic to a public web server located on a DMZ is intermittently being blocked. The firewall configuration includes an ACL that permits traffic to the web server's IP address on TCP 443, but also includes a general deny rule for all other traffic. The engineer notices that the permit rule is placed after a deny rule that blocks traffic from a specific source subnet that is used by internal users for testing. The internal users report that they can access the web server, but external users sometimes experience timeouts. What is the most likely cause of the intermittent blocking?
medium
✓ A.The permit rule for HTTPS is not hitting because traffic is being matched by a preceding deny rule.
B.The external users are hitting the firewall's connection limit.
C.The ASA is performing NAT incorrectly for the web server traffic.
D.The ASA is experiencing high CPU utilization causing packet drops.
Why A: The most likely cause is that the permit rule for HTTPS (TCP 443) is placed after a deny rule that blocks traffic from a specific source subnet. Since ACLs on a Cisco ASA are processed sequentially from top to bottom, if a packet matches the earlier deny rule, it will be dropped before reaching the permit rule. This explains why external users (who may be sourced from the blocked subnet or whose traffic is inadvertently matched by the deny rule due to overlapping or misconfigured source conditions) experience intermittent timeouts, while internal users from a different subnet are not affected.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.