- A
Create an ACL that permits all inbound and outbound traffic between DMZ and internet.
Why wrong: Overly permissive, defeats purpose of DMZ segmentation.
- B
Create an ACL that permits established connections inbound, and allows HTTP/HTTPS from DMZ to internet with application inspection.
Balances security and functionality by inspecting traffic and limiting outbound to necessary services.
- C
Create an ACL that permits inbound web traffic to the DMZ server and permits all outbound traffic from DMZ with no inspection.
Why wrong: Allowing all outbound without inspection increases risk of malware exfiltration.
- D
Create an ACL that permits inbound web traffic to the DMZ server and denies all outbound traffic from DMZ.
Why wrong: Denies software updates, breaking functionality.
Quick Answer
The answer is to create an ACL that permits established connections inbound and allows HTTP/HTTPS from the DMZ to the internet with application inspection. This approach is correct because the established keyword on the inbound ACL safely permits return traffic for the web server’s incoming connections without opening a broad inbound hole, while the outbound ACL explicitly restricts DMZ-initiated traffic to only HTTP and HTTPS, and application inspection enforces protocol compliance and stateful tracking. On the Cisco SCOR 350-701 exam, this scenario tests your understanding of the principle of least privilege in ASA DMZ access control design—a common trap is to allow all outbound traffic from the DMZ, which creates a pivot point for attackers. Instead, remember the memory tip: “Established in, inspected out—DMZ stays tight, no doubt.”
350-701 Network Security Practice Question
This 350-701 practice question tests your understanding of network security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is deploying a new ASA firewall in a DMZ design. They need to allow web traffic from the internet to a web server in the DMZ, while also permitting outbound traffic from the DMZ to the internet for software updates. Which access control approach best meets these requirements with minimal risk?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"best"Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Create an ACL that permits established connections inbound, and allows HTTP/HTTPS from DMZ to internet with application inspection.
Option B is correct because it uses the 'established' keyword to allow return traffic for inbound web connections while explicitly permitting outbound HTTP/HTTPS with application inspection. This minimizes risk by not blindly allowing all outbound traffic, and inspection ensures protocol compliance and stateful tracking.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an ACL that permits all inbound and outbound traffic between DMZ and internet.
Why it's wrong here
Overly permissive, defeats purpose of DMZ segmentation.
- ✓
Create an ACL that permits established connections inbound, and allows HTTP/HTTPS from DMZ to internet with application inspection.
Why this is correct
Balances security and functionality by inspecting traffic and limiting outbound to necessary services.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Create an ACL that permits inbound web traffic to the DMZ server and permits all outbound traffic from DMZ with no inspection.
Why it's wrong here
Allowing all outbound without inspection increases risk of malware exfiltration.
- ✗
Create an ACL that permits inbound web traffic to the DMZ server and denies all outbound traffic from DMZ.
Why it's wrong here
Denies software updates, breaking functionality.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that simply allowing 'established' connections is sufficient for outbound traffic, but the trap here is that the question explicitly requires outbound HTTP/HTTPS for updates, which must be explicitly permitted and inspected, not just allowed as return traffic.
Detailed technical explanation
How to think about this question
The 'established' keyword in ASA ACLs matches TCP packets with the ACK or RST bit set, allowing return traffic for connections initiated from the inside. Application inspection (e.g., 'inspect http') goes further by enforcing RFC compliance, tracking session state, and preventing protocol anomalies. In real-world deployments, outbound traffic from DMZ should be restricted to specific destinations (e.g., update servers) and inspected to prevent data leakage.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Network Security — study guide chapter
Learn the concepts, then practise the questions
- →
Network Security practice questions
Targeted practice on this topic area only
- →
All 350-701 questions
500 questions across all exam domains
- →
Cisco SCOR / CCNP Security Core 350-701 study guide
Full concept coverage aligned to exam objectives
- →
350-701 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related 350-701 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Endpoint Protection and Detection practice questions
Practise 350-701 questions linked to Endpoint Protection and Detection.
Secure Network Access, Visibility and Enforcement practice questions
Practise 350-701 questions linked to Secure Network Access, Visibility and Enforcement.
Security Concepts practice questions
Practise 350-701 questions linked to Security Concepts.
Network Security practice questions
Practise 350-701 questions linked to Network Security.
Cloud Security practice questions
Practise 350-701 questions linked to Cloud Security.
Content Security practice questions
Practise 350-701 questions linked to Content Security.
350-701 fundamentals practice questions
Practise 350-701 questions linked to 350-701 fundamentals.
350-701 scenario practice questions
Practise 350-701 questions linked to 350-701 scenario.
350-701 troubleshooting practice questions
Practise 350-701 questions linked to 350-701 troubleshooting.
Practice this exam
Start a free 350-701 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this 350-701 question test?
Network Security — This question tests Network Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Create an ACL that permits established connections inbound, and allows HTTP/HTTPS from DMZ to internet with application inspection. — Option B is correct because it uses the 'established' keyword to allow return traffic for inbound web connections while explicitly permitting outbound HTTP/HTTPS with application inspection. This minimizes risk by not blindly allowing all outbound traffic, and inspection ensures protocol compliance and stateful tracking.
What should I do if I get this 350-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More 350-701 practice questions
- A network engineer is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration includes a crypto m…
- An engineer is configuring Cisco ISE for guest access. The requirement is that guests must accept an acceptable use poli…
- A financial company has a data center with Cisco FTD firewalls in a high-availability pair. They use Cisco ISE for netwo…
- A company is implementing Cisco Umbrella to provide DNS-layer security. They want to block access to known malicious dom…
- Which THREE are characteristics of Cisco Stealthwatch?
- Which TWO are valid methods for implementing Network Admission Control (NAC) in a Cisco environment?
Last reviewed: Jun 25, 2026
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.