The answer is to enable TCP Intercept with a low threshold, as this directly addresses the SYN flood mitigation scenario where a server behind a Cisco ASA is hit with rapid connection attempts from diverse source IPs. TCP Intercept works by having the ASA proxy the initial three-way handshake on behalf of the protected server, completing the SYN-ACK and waiting for the final ACK from the client before establishing the real connection to the server. This shields the server from half-open connection table exhaustion while allowing legitimate traffic to pass, even when source IPs change constantly. On the Cisco SCOR 350-701 exam, this question tests your ability to differentiate between stateful firewall inspection, connection limits, and TCP Intercept—a common trap is choosing a simple access-list block, which would deny all unknown sources and break legitimate access. Remember the mnemonic: “Intercept protects the server’s handshake, not just the firewall’s state table.”
350-701 Security Concepts Practice Question
This 350-701 practice question tests your understanding of security concepts. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
During a security incident, it is observed that a server behind a Cisco ASA is being accessed repeatedly with different source IPs in a short time. The firewall logs show many dropped packets to the server's IP on port 443. What is the most effective mitigation to reduce the impact while maintaining legitimate access?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable TCP Intercept with a low threshold
TCP Intercept with a low threshold is the most effective mitigation because it protects the server from a SYN flood attack by intercepting TCP SYN packets and completing the three-way handshake on behalf of the server. This allows legitimate traffic to proceed while dropping excessive SYN requests from rapidly changing source IPs, which is exactly the behavior described in the scenario. Unlike other options, TCP Intercept dynamically manages connection attempts without blocking all unknown sources or disrupting legitimate access.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Increase the connection timeout
Why it's wrong here
Increasing timeout may worsen the impact by holding more table entries.
✗
Implement an access-list to allow only known source IPs
Why it's wrong here
Unknown sources would be legitimate users, so this is impractical.
✗
Configure a static route to null0 for the server's IP
Why it's wrong here
Null routing drops all traffic to that IP, including legitimate.
✓
Enable TCP Intercept with a low threshold
Why this is correct
TCP Intercept mitigates SYN floods by intercepting and verifying connections.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between reactive mitigation (TCP Intercept) and static or blocking measures, leading candidates to choose access-lists or null routes that completely deny access instead of dynamically protecting the server.
Detailed technical explanation
How to think about this question
TCP Intercept works in two modes: intercept mode, where the ASA completes the three-way handshake with the client and then initiates a new handshake with the server, and watch mode, where it monitors connections and drops those that exceed a threshold. The low threshold (e.g., 100 incomplete connections per minute) triggers the ASA to aggressively drop new SYN packets once the limit is reached, preventing the server's connection queue from overflowing. In real-world scenarios, this is often combined with TCP normalization and SYN cookies for defense against distributed SYN floods.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security Concepts — This question tests Security Concepts — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Enable TCP Intercept with a low threshold — TCP Intercept with a low threshold is the most effective mitigation because it protects the server from a SYN flood attack by intercepting TCP SYN packets and completing the three-way handshake on behalf of the server. This allows legitimate traffic to proceed while dropping excessive SYN requests from rapidly changing source IPs, which is exactly the behavior described in the scenario. Unlike other options, TCP Intercept dynamically manages connection attempts without blocking all unknown sources or disrupting legitimate access.
What should I do if I get this 350-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.