mediumMultiple ChoiceObjective-mapped
350-701 An ASA firewall is configured as shown Practice Question
Exhibit
Refer to the exhibit. ``` interface GigabitEthernet0/0 nameif inside security-level 100 ip address 10.1.1.1 255.255.255.0 ! interface GigabitEthernet0/1 nameif outside security-level 0 ip address 198.51.100.1 255.255.255.0 ! access-list OUTSIDE extended permit tcp any host 198.51.100.100 eq https ! access-group OUTSIDE in interface outside ! route outside 0.0.0.0 0.0.0.0 198.51.100.2 ```
An ASA firewall is configured as shown. A web server is behind the ASA with IP 10.1.1.100. Which additional configuration is required to allow HTTPS traffic from the internet to the web server?
⚠ Common exam trap
Watch out — candidates often assume a route or security level adjustment is sufficient, but Cisco specifically tests that NAT is mandatory for translating private addresses to public addresses in ASA firewall configurations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure static NAT for the web server
The ASA firewall requires static NAT to translate the public IP address (typically the ASA's outside interface IP or a dedicated public IP) to the private IP address of the web server (10.1.1.100). Without static NAT, the ASA will not perform the necessary destination address translation for inbound HTTPS traffic, and the web server's private IP is not routable on the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a route to the web server's subnet
Why it's wrong here
A route is already configured for default; no additional route needed.
- ✓
Configure static NAT for the web server
Why this is correct
Static NAT is necessary to map the public IP to the internal server.
- ✗
Increase the security level of the inside interface
Why it's wrong here
The inside is already 100, which is higher than outside.
- ✗
Apply the access-group to the inside interface
Why it's wrong here
The access-list is correctly applied to the outside interface for inbound traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.