hardMultiple ChoiceObjective-mapped
350-701 Practice Question: Refer to the exhibit
Exhibit
policy-map type inspect INSPECT-POLICY class type inspect BAD_TRAFFIC drop class type inspect GOOD_TRAFFIC inspect ! class-map type inspect match-any BAD_TRAFFIC match protocol dns match protocol ms-sql ! class-map type inspect match-any GOOD_TRAFFIC match access-group 100 ! zone security INSIDE zone security OUTSIDE zone-pair security ZP-IN-2-OUT source INSIDE destination OUTSIDE service-policy type inspect INSPECT-POLICY
Refer to the exhibit. A network engineer applies a zone-based firewall policy to a router. Users in the INSIDE zone report they can access HTTP servers on the OUTSIDE zone but cannot resolve DNS names or access MS-SQL servers. What does the policy do to DNS and MS-SQL traffic?
⚠ Common exam trap
Cisco often tests the misconception that 'inspect' in class-default automatically allows all traffic, but the trap here is that explicit 'drop' actions in higher-priority class maps (like BAD_TRAFFIC) override any default inspection, causing candidates to overlook the sequential processing order of class maps in a policy-map.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
They are dropped because the BAD_TRAFFIC class explicitly drops them.
The zone-based firewall policy explicitly defines a class map (BAD_TRAFFIC) that matches DNS (UDP/53) and MS-SQL (TCP/1433) traffic and applies the 'drop' action. Since the policy-map uses a 'class-default' action of 'inspect' for GOOD_TRAFFIC, any traffic not matching GOOD_TRAFFIC but matching BAD_TRAFFIC is dropped before inspection can occur. The users' symptoms confirm that DNS and MS-SQL are being dropped, while HTTP (matched by GOOD_TRAFFIC) is inspected and allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
They are allowed because no 'inspect' action is applied to the class.
Why it's wrong here
The class has a 'drop' action, so they are blocked.
- ✓
They are dropped because the BAD_TRAFFIC class explicitly drops them.
Why this is correct
The class BAD_TRAFFIC includes DNS and MS-SQL and applies the drop action.
- ✗
They are inspected and allowed through the firewall.
Why it's wrong here
The policy drops them, not inspects.
- ✗
They are dropped because they do not match the GOOD_TRAFFIC class.
Why it's wrong here
They actually match BAD_TRAFFIC and are explicitly dropped.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.