- A
A pre-filter rule with a lower priority (higher number) is matching the traffic first and allowing it
Pre-filter rules are evaluated in order; if a rule with a lower priority (higher number) matches first, it could allow traffic that should be blocked.
- B
The pre-filter rules are configured with the wrong source interface
Why wrong: Interface misconfiguration could cause the rule not to match, but the engineer specified source IPs, so interface is not the primary issue.
- C
The access control policy is overriding the pre-filter policy
Why wrong: Pre-filter rules are evaluated before access control, so they take precedence.
- D
The default action for the pre-filter policy is set to 'Allow'
Why wrong: Default action of 'Allow' would allow traffic that doesn't match any rule, but the traffic matches a rule that blocks, so that shouldn't happen.
Quick Answer
The answer is that a pre-filter rule with a lower priority (higher number) is matching the traffic first and allowing it. This occurs because Cisco FTD evaluates pre-filter policy rules in strict sequential order based on their priority number, where lower numbers indicate higher priority and are evaluated first. If a rule with a higher priority number (lower priority) is configured to allow traffic and appears earlier in the sequence than a lower-numbered block rule, the traffic will be permitted before ever reaching the intended block action. On the Cisco SCOR 350-701 exam, this concept tests your understanding of rule ordering within pre-filter policies, a common trap where candidates assume all block rules are evaluated before allow rules regardless of sequence. The key memory tip is "first match wins" in pre-filter policies, so always check the rule order from top (priority 1) to bottom, not just the action type.
350-701 Network Security Practice Question
This 350-701 practice question tests your understanding of network security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An engineer is configuring Cisco Firepower Threat Defense (FTD) with a pre-filter policy to block traffic from known malicious IP addresses before it reaches the access control policy. The pre-filter rules are configured to block traffic from the malicious IPs. However, the engineer notices that some traffic from those IPs is still being allowed. What is the most likely reason?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"most likely"Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
A pre-filter rule with a lower priority (higher number) is matching the traffic first and allowing it
Pre-filter rules are evaluated in order of priority (lower numbers first). If a rule with a higher priority number (lower priority) is configured to allow traffic, it will be matched before a lower-numbered (higher priority) block rule if the allow rule appears earlier in the sequence. This causes the traffic to be permitted before reaching the intended block rule, which is why some malicious IP traffic is still allowed.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A pre-filter rule with a lower priority (higher number) is matching the traffic first and allowing it
Why this is correct
Pre-filter rules are evaluated in order; if a rule with a lower priority (higher number) matches first, it could allow traffic that should be blocked.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
The pre-filter rules are configured with the wrong source interface
Why it's wrong here
Interface misconfiguration could cause the rule not to match, but the engineer specified source IPs, so interface is not the primary issue.
- ✗
The access control policy is overriding the pre-filter policy
Why it's wrong here
Pre-filter rules are evaluated before access control, so they take precedence.
- ✗
The default action for the pre-filter policy is set to 'Allow'
Why it's wrong here
Default action of 'Allow' would allow traffic that doesn't match any rule, but the traffic matches a rule that blocks, so that shouldn't happen.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that pre-filter rules are evaluated in the order they appear in the GUI (which is by rule number), and that a higher-priority (lower number) rule can be accidentally placed after a lower-priority (higher number) rule if the engineer does not manually assign rule numbers or reorder them correctly.
Detailed technical explanation
How to think about this question
In Cisco FTD, the pre-filter policy is processed in the fast path before the access control policy, using a sequential rule base with priority numbers (1–65535). Each rule has a 'rule number' that determines evaluation order; lower numbers are evaluated first. If a rule with a higher number (e.g., rule 10) is configured to allow traffic from a specific source IP, and a rule with a lower number (e.g., rule 5) is configured to block the same IP, the rule with the lower number (higher priority) will be evaluated first and block the traffic. However, if the allow rule has a lower number (e.g., rule 2) and the block rule has a higher number (e.g., rule 8), the allow rule matches first and permits the traffic, bypassing the block rule. This is a common misconfiguration when rules are added without considering existing rule numbers.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Network Security — study guide chapter
Learn the concepts, then practise the questions
- →
Network Security practice questions
Targeted practice on this topic area only
- →
All 350-701 questions
500 questions across all exam domains
- →
Cisco SCOR / CCNP Security Core 350-701 study guide
Full concept coverage aligned to exam objectives
- →
350-701 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related 350-701 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Endpoint Protection and Detection practice questions
Practise 350-701 questions linked to Endpoint Protection and Detection.
Secure Network Access, Visibility and Enforcement practice questions
Practise 350-701 questions linked to Secure Network Access, Visibility and Enforcement.
Security Concepts practice questions
Practise 350-701 questions linked to Security Concepts.
Network Security practice questions
Practise 350-701 questions linked to Network Security.
Cloud Security practice questions
Practise 350-701 questions linked to Cloud Security.
Content Security practice questions
Practise 350-701 questions linked to Content Security.
350-701 fundamentals practice questions
Practise 350-701 questions linked to 350-701 fundamentals.
350-701 scenario practice questions
Practise 350-701 questions linked to 350-701 scenario.
350-701 troubleshooting practice questions
Practise 350-701 questions linked to 350-701 troubleshooting.
Practice this exam
Start a free 350-701 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this 350-701 question test?
Network Security — This question tests Network Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: A pre-filter rule with a lower priority (higher number) is matching the traffic first and allowing it — Pre-filter rules are evaluated in order of priority (lower numbers first). If a rule with a higher priority number (lower priority) is configured to allow traffic, it will be matched before a lower-numbered (higher priority) block rule if the allow rule appears earlier in the sequence. This causes the traffic to be permitted before reaching the intended block rule, which is why some malicious IP traffic is still allowed.
What should I do if I get this 350-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.