hardMultiple ChoiceObjective-mapped
350-701 Practice Question: During a security incident, it is observed that a…
During a security incident, it is observed that a server behind a Cisco ASA is being accessed repeatedly with different source IPs in a short time. The firewall logs show many dropped packets to the server's IP on port 443. What is the most effective mitigation to reduce the impact while maintaining legitimate access?
⚠ Common exam trap
Cisco often tests the distinction between reactive mitigation (TCP Intercept) and static or blocking measures, leading candidates to choose access-lists or null routes that completely deny access instead of dynamically protecting the server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable TCP Intercept with a low threshold
TCP Intercept with a low threshold is the most effective mitigation because it protects the server from a SYN flood attack by intercepting TCP SYN packets and completing the three-way handshake on behalf of the server. This allows legitimate traffic to proceed while dropping excessive SYN requests from rapidly changing source IPs, which is exactly the behavior described in the scenario. Unlike other options, TCP Intercept dynamically manages connection attempts without blocking all unknown sources or disrupting legitimate access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the connection timeout
Why it's wrong here
Increasing timeout may worsen the impact by holding more table entries.
- ✗
Implement an access-list to allow only known source IPs
Why it's wrong here
Unknown sources would be legitimate users, so this is impractical.
- ✗
Configure a static route to null0 for the server's IP
Why it's wrong here
Null routing drops all traffic to that IP, including legitimate.
- ✓
Enable TCP Intercept with a low threshold
Why this is correct
TCP Intercept mitigates SYN floods by intercepting and verifying connections.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.