easyMultiple ChoiceObjective-mapped
350-701 Practice Question: Refer to the exhibit
Exhibit
%ASA-4-106023: Deny tcp src outside:203.0.113.50/443 dst DMZ:10.10.10.10/80 by access-group "OUTSIDE"
Refer to the exhibit. A security analyst sees this syslog message on a Cisco ASA. What does it indicate?
⚠ Common exam trap
Cisco often tests the order of IP addresses in syslog messages—candidates mistakenly assume the first IP is the destination, but in ASA syslogs, the source IP is listed first, leading to reversed direction errors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A TCP connection from 203.0.113.50 to 10.10.10.10 was denied by the ACL named OUTSIDE.
The syslog message shows an ACL deny action on the OUTSIDE interface for a TCP connection from source 203.0.113.50 to destination 10.10.10.10. The format '%ASA-4-106023' indicates a deny, and the interface name 'OUTSIDE' is explicitly stated. The source IP is listed first in the message, confirming the connection attempt originated from 203.0.113.50.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A TCP connection from 10.10.10.10 to 203.0.113.50 was denied.
Why it's wrong here
The message shows source as 203.0.113.50 and destination as 10.10.10.10.
- ✓
A TCP connection from 203.0.113.50 to 10.10.10.10 was denied by the ACL named OUTSIDE.
Why this is correct
The syslog clearly indicates a deny by access-group OUTSIDE.
- ✗
A TCP connection from 203.0.113.50 to 10.10.10.10 was allowed and logged.
Why it's wrong here
The message says 'Deny', not 'Allow'.
- ✗
The ASA interface OUTSIDE is experiencing high CPU due to Denial of Service.
Why it's wrong here
The message is a single deny log, not an indication of high CPU or DoS.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.