350-701 Network Security Practice Question
An engineer is configuring Cisco Firepower Threat Defense (FTD) in inline NGFW mode. The access control policy must block all traffic from geolocation 'North Korea' and allow all other traffic. Which type of rule should be used and in what order should it be placed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block rule with source geolocation North Korea, placed at the top of the policy.
Geolocation filtering is applied in access control rules. The block rule must be placed before any allow rules to ensure traffic from North Korea is blocked. Rule order is top-down.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Block rule with source geolocation North Korea, placed at the top of the policy.
Why this is correct
Correct. Block rule at the top ensures all traffic from North Korea is blocked before any allow rule is evaluated.
- ✗
Intrusion policy with geolocation filter, placed before access control rules.
Why it's wrong here
Geolocation filtering is not done in intrusion policies; it's in access control rules.
- ✗
Block rule with source geolocation North Korea, placed at the bottom of the policy.
Why it's wrong here
Placing at the bottom may cause traffic to be allowed by a higher rule.
- ✗
Permit rule with destination geolocation North Korea, placed at the top.
Why it's wrong here
A permit rule would allow traffic, not block.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.